# \[ANNOUNCEMENT\] Dropbox node versie 2.1.0 (beta) - refresh token refactored

**URL:** <https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312>\
**Category:** Developing Nodes\
**Created:** [6 January 2023 22:05 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312 "2023-01-06T22:05:50Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [6 January 2023 22:05 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/1 "2023-01-06T22:05:50Z")

</div>

Hi folks,

We introduced in version 2.0.0 of the dropbox node the concept of refresh tokens, to allow this node to support the new stronger Dropbox security guidelines.

However our mechanism was based on OAauth2 redirect url's, which required the connection between Node-RED and the flow editor to be SSL with certificates signed by a trusted CA (e.g. LetsEncrypt). Normally it is bad practice to use plain HTTP, however when everything (flow editor, Node-RED, ...) is located in a secure LAN behind a firewall this should be possible.

Therefore I have completely refactored the code, and now the Oauth2 related code is completely moved to the frontend part of the Dropbox node. Now it allows both HTTP and HTTPS connections.  
\*_ **CAUTION: it is highly disadvised to use plain HTTP outside your LAN!! And even within your LAN it is better to use HTTPS.** _  
But of course that is a general guideline, and is not specific for this node. So I would like to not discuss that further here, and keep this discussion focussed on the Dropbox node...

The below diagram shows an overview of the entire refresh token request flow:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/f/3/f3ceecb87d14c4b4d7202daed6b5a05b416baf45.png)

The pull request has been submitted:

> <https://github.com/node-red/node-red-web-nodes/pull/305>
>
> \- \[X \] Bugfix (non-breaking change which fixes an issue)
> \- \[\] New feature (no…n-breaking change which adds functionality)
> 
> Discussed on Discourse (see \[here\](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949)).
> 
> \## Proposed changes
> Some time ago Dropbox has enforced their security. The long live access tokens had become short live (i.e. 4 hour). From then on a refresh token was required, which can be used to request new access tokens over and over again.
> 
> So we had introduced refresh tokens in version 2.0.0 of the Dropbox node. That version introduced a few new endpoints, that allowed us to call functions from the Dropbox SDK to accomplish this. And that version also used the OAuth redirect url mechanism: at the end of the OAuth2 authorization flow, the redirect url is called to pass the result (i.e. the refresh token) to Node-RED.
> 
> However Dropbox requires an SSL connection (between the flow editor and Node-RED) with certificates signed by a trusted CA, or a localhost url. Otherwise they won't call the redirect url, since it will be considered unsecure. Seems that a lot of users use plain HTTP, so they cannot request refresh tokens and as a result they cannot use the dropbox node anymore (see for example this \[issue\](https://github.com/node-red/node-red-web-nodes/issues/304)). And of course when both the flow editor and Node-RED are located inside a secure LAN behind a firewall, stuff like that should be possible.
> 
> To solve this, I have removed all the endpoints again. That way no Dropbox related data is being transferred to Node-RED anymore, to avoid security issues in case plain HTTP is being used. Of course at the end the refresh token will be stored in a credential and transferred to Node-RED.
> 
> But since the endpoints were removed, I could not call the Dropbox SDK anymore. Therefore I have implemented the same functionality in the frontend, which I previously called from the SDK. The main problem was that the Crypto Web API SHA256 digest hash function is only available in the browser when you have a secure context, i.e. when an SSL connection to Node-RED is being used. The browser doesn't offer that function in case of HTTP, because they want to avoid that you transfer it over plain HTTP. However we transfer it not to Node-RED, but via SSL to Dropbox. Since this is not an issue for our use case, a custom SHA256 hash implementation is loaded from the "resource" folder, which is being used in the frontend when the browser doesn't offer this functionality:
> 
> !\[image\](https://user-images.githubusercontent.com/14224149/211106143-c584b229-201f-48d0-81c0-7665ae20d48b.png)
> 
> Below you can find an overview of the entire refresh token request process, which you can see is now completely managed by the dropbox node frontend code:
> 
> !\[image\](https://user-images.githubusercontent.com/14224149/211106025-7d2afac0-ce2e-4816-b355-8bfb05c87141.png)
> 
> So this should work for both HTTP and HTTPS connections. 
> 
> \## Checklist
> \- \[X \] I have read the \[contribution guidelines\](https://github.com/node-red/node-red-nodes/blob/master/CONTRIBUTING.md)
> \- \[X \] For non-bugfix PRs, I have discussed this change on the forum/slack team.
> \- \[\] I have run \`grunt\` to verify the unit tests pass
> \- \[\] I have added suitable unit tests to cover the new/changed functionality

It would be nice if some folks could test this change. Otherwise we will risc (again) to publish a version that is not widely usable by all users.

However I am not quite sure what is the easiest way to test this version, since the dropbox node is part of a suite of other nodes. Hopefully somebody can share here some tips about that.

Hopefully it now works for everybody...  
Bart

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [6 January 2023 22:22 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/2 "2023-01-06T22:22:41Z")

</div>

> [@BartButenaers](#):
>
> It would be nice if some folks could test this change

I recall that @Colin has previously found a way to install direct from your repo (which I can't find now 🤔)  
Could you re-post pls Colin?

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 07:35 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/3 "2023-01-07T07:35:40Z")

</div>

> [@Paul-Reed](#):
>
> I recall that @Colin has previously found a way to install direct from your repo

I think [this](https://discourse.nodered.org/t/refresh-tokens-in-node-red-node-dropbox-now-published-as-v2-0-0/65610/40) is the installation procedure from @Colin that you were referring to.  
So it would be nice if some people could test this, before I publish it for the big audience.  
Thanks!

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 08:32 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/4 "2023-01-07T08:32:16Z")

</div>

> [@BartButenaers](#):
>
> The below diagram shows an overview of the entire refresh token request flow:

I have now turned my language in Dropbox from Dutch to English to show the screenshots in English:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/8/e/8e809641dd682c1c87c28f40c96a5faaf32a7a38.png)

I think this diagram should be added to the readme page of the dropbox node. Unlike in the previous version were my diagram explained the technical flow between the endpoints, this new diagram only explains which screens the user will get to see.

Such diagrams help me to see where I the process I am situated. Like e.g. when I am configuring my Google home node, I always get lost in what I am doing at the moment. Or whether it is normal if I see some screen at some time within the process....

---

<div class="post-metadata">

**Author:** ![Frida](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/frida/32/68250_2.png) [@Frida](https://discourse.nodered.org/u/Frida)\
**Post date:** [7 January 2023 10:09 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/5 "2023-01-07T10:09:06Z")

</div>

Where do you store the beta? With Colin's directions I only get version 2.0.0

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 10:13 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/6 "2023-01-07T10:13:22Z")

</div>

Hi @Frida,  
Thanks for testing!  
It is in my Github repository under the "dropbox-refresh-token-refactored" branch.  
So I think that between the `cd` and `npm install` you need to do `git checkout dropbox-refresh-token-refactored`. That way git will get the files from that branch and store it in your directory...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2023 10:34 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/7 "2023-01-07T10:34:32Z")

</div>

> [@BartButenaers](#):
>
> I think [this](https://discourse.nodered.org/t/refresh-tokens-in-node-red-node-dropbox-now-published-as-v2-0-0/65610/40) is the installation procedure from @Colin that you were referring to.

Because your changes are in a branch, this is the revised process to test the new version;

```auto
cd ~
git clone --single-branch --branch dropbox-refresh-token-refactored https://github.com/bartbutenaers/node-red-web-nodes
cd node-red-web-nodes/dropbox
npm install
cd ~/.node-red
npm install ~/node-red-web-nodes/dropbox
node-red-stop;node-red-start

```

@BartButenaers - I've repeated the whole process 3 times this morning, and uploaded numerous sample files without issue. It was very quick & easy, and the instructions are very clear 🎉

The only suggestion I'd make would be to change the button label top right of node properties from 'Update' to 'Save', which may be a more natural process for users.

![drop](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/a/c/ac87b9db0a8ef598eb6ff9454c492fe4a7a8247f.jpeg)

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 11:03 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/8 "2023-01-07T11:03:40Z")

</div>

> [@Paul-Reed](#):
>
> change the button label top right of node properties from 'Update' to 'Save',

Hey @Paul-Reed,  
Thanks for testing!!  
I assume you have tested only via https to Node-RED?  
Will have a look tonight whether I can change that button label. Never had a look at it. Thought it was always looking the same for all nodes...

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2023 11:39 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/9 "2023-01-07T11:39:43Z")

</div>

> [@BartButenaers](#):
>
> I assume you have tested only via https to Node-RED?

Yes, correct.

---

<div class="post-metadata">

**Author:** ![Frida](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/frida/32/68250_2.png) [@Frida](https://discourse.nodered.org/u/Frida)\
**Post date:** [7 January 2023 14:42 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/10 "2023-01-07T14:42:11Z")

</div>

It was just what was missing. First tried directly on an rpi locally. Then on another rpi from a mac.  
Everything went according to plan.  
Thanks for a good piece of advice.

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 16:59 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/11 "2023-01-07T16:59:17Z")

</div>

@Frida,  
Did you use a http or a https connection for your flow editor while testing?

---

<div class="post-metadata">

**Author:** ![Frida](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/frida/32/68250_2.png) [@Frida](https://discourse.nodered.org/u/Frida)\
**Post date:** [7 January 2023 17:57 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/12 "2023-01-07T17:57:12Z")

</div>

[http://192.168.5.85:1880/#flow/xxx...xxx](http://192.168.5.85:1880/#flow/xxx...xxx)  
It's http I can see.

---

<div class="post-metadata">

**Author:** ![Buckskin](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@Buckskin](https://discourse.nodered.org/u/Buckskin)\
**Post date:** [7 January 2023 20:17 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/13 "2023-01-07T20:17:55Z")

</div>

@BartButenaers Just tried the new node, everything went fine until the OAuth2 pop-up. This worked but gave an error message

```auto
This app has reached its user limit. Contact the app developer and ask them to use the Dropbox API App Console to increase their app's user limit.

```

Edit: using HTTP from browser on PC with Node-RED on Ubuntu in a VM. Will try on a Pi

Tried on Pi and got

```auto
npm WARN dropbox@10.34.0 requires a peer of @types/node-fetch@^2.5.7 but none is installed. You must install peer dependencies yourself.

```

What have I missed?

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2023 20:33 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/14 "2023-01-07T20:33:32Z")

</div>

> [@Buckskin](#):
>
> `This app has reached its user limit`

Did you just try it once and got the error, or did you get it after several attempts?  
I've had that same error (with the previous Dropbox version) after I had made a silly mistake in entering the credentials (my fault!). I tried a few times, then got the 'user limit' message.  
I left it a few hours, corrected my error, and then everything worked OK.

---

<div class="post-metadata">

**Author:** ![Buckskin](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@Buckskin](https://discourse.nodered.org/u/Buckskin)\
**Post date:** [7 January 2023 20:37 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/15 "2023-01-07T20:37:27Z")

</div>

> [@Paul-Reed](#):
>
> Did you just try it once and got the error, or did you get it after several attempts?

Just the once.

Full log from `npm install ~/node-red-web-nodes/dropbox`

```auto
pi@PiVPN:~/.node-red $ npm install ~/node-red-web-nodes/dropbox
npm WARN dropbox@10.34.0 requires a peer of @types/node-fetch@^2.5.7 but none is installed. You must install peer dependencies yourself.

npm ERR! code ENOENT
npm ERR! syscall rename
npm ERR! path /home/pi/.node-red/node_modules/.staging/node-red-node-dropbox-83c3ac53/node_modules/balanced-match
npm ERR! dest /home/pi/.node-red/node_modules/.staging/balanced-match-cab3dc10
npm ERR! errno -2
npm ERR! enoent ENOENT: no such file or directory, rename '/home/pi/.node-red/node_modules/.staging/node-red-node-dropbox-83c3ac53/node_modules/balanced-match' -> '/home/pi/.node-red/node_modules/.staging/balanced-match-cab3dc10'
npm ERR! enoent This is related to npm not being able to find a file.
npm ERR! enoent

npm ERR! A complete log of this run can be found in:
npm ERR! /home/pi/.npm/_logs/2023-01-07T20_41_40_043Z-debug.log

```

---

<div class="post-metadata">

**Author:** ![Paul-Reed](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/paul-reed/32/66906_2.png) [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)\
**Post date:** [7 January 2023 20:45 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/16 "2023-01-07T20:45:02Z")

</div>

> [@Buckskin](#):
>
> `npm WARN dropbox@10.34.0 requires a peer of @types/node-fetch@^2.5.7`

Is your OS up to date:  
`sudo apt update && sudo apt full-upgrade`

---

<div class="post-metadata">

**Author:** ![Buckskin](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@Buckskin](https://discourse.nodered.org/u/Buckskin)\
**Post date:** [7 January 2023 20:53 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/17 "2023-01-07T20:53:11Z")

</div>

Yes

`0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded`

Pi running on Buster (If that makes any difference)

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 22:52 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/18 "2023-01-07T22:52:35Z")

</div>

> [@Buckskin](#):
>
> `This app has reached its user limit.`

I had a similar issue last week when I used the dropbox app from @Paul-Reed to test. But then I switched to my own app and the issue hasn't occured anymore.

I am not using Dropbox myself so I am not a specialist. But read this somewhere:  
_If you have created your own Dropbox app, you can only connect to it from one domain and for 1 Dropbox account. However you can increase the number of accounts/domains without applying for production by clicking on 'Enable additional users' in the App Console ([Login - Dropbox](https://www.dropbox.com/developers/apps))._

I suspect this was my problem: Paul had accessed his test dropbox account via domain A (e.g. https;[//domain.from.paul](https://domain.from.paul)) and I wanted to access the same dropbox account via domain B (e.g. [https://domain.from.bart](https://domain.from.bart)). Which seems not to be allowed. Did you do anything similar in your test?

The setting looks like this in my own Dropbox account, so I assume I can also use it only via one domain:

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/1/419f64f27bda00c47bc23141ca5a838f88ea3096.png)

> [@Buckskin](#):
>
> Tried on Pi and got
> 
> ```auto
> npm WARN dropbox@10.34.0 requires a peer of @types/node-fetch@^2.5.7 but none is installed. You must install peer dependencies yourself.
> 
> ```

I have no clue. I haven't used node-fetch in my code. I see [here](https://github.com/dropbox/dropbox-sdk-js/blob/main/package.json#L108) that the dropbox (sdk) library uses `@types/node-fetch` as a peer dependency. But I haven't changed anything about that: the dropbox node was already using the dropbox javascript sdk library in the past.

I assume it now occurs for you because [here](https://github.com/dropbox/dropbox-sdk-js/blob/master/src/auth.js#L323) it seems that the dropbox SDK uses node-fetch to refresh the access token (based on your refresh token).

But I don't use npm enough to troubleshoot this. Hopefully somebody else can give some tips...  
Should I perhaps add the node-fetch library as a dependency to the dropbox node?

---

<div class="post-metadata">

**Author:** ![BartButenaers](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/bartbutenaers/32/10476_2.png) [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)\
**Post date:** [7 January 2023 23:03 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/19 "2023-01-07T23:03:39Z")

</div>

> [@BartButenaers](#):
>
> If you have created your own Dropbox app, you can only connect to it from one domain and for 1 Dropbox account. However you can increase the number of accounts/domains without applying for production by clicking on 'Enable additional users' in the App Console ([Login - Dropbox](https://www.dropbox.com/developers/apps)).

[Here](https://www.dropbox.com/developers/reference/developer-guide#production-approval) you can find the official documentation. So it seems indeed - while your app is still in development mode- you can allow more clients to access your app, via that setting in your Dropbox account. I haven't tested it!

---

<div class="post-metadata">

**Author:** ![Buckskin](https://avatars.discourse-cdn.com/v4/letter/b/b9e5f3/32.png) [@Buckskin](https://discourse.nodered.org/u/Buckskin)\
**Post date:** [7 January 2023 23:28 UTC](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312/20 "2023-01-07T23:28:20Z")

</div>

> [@BartButenaers](#):
>
> ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/1/419f64f27bda00c47bc23141ca5a838f88ea3096.png)
> 
> image856×129 2.96 KB

Tried that and it worked although I may have messed up somewhere else before (now shows 1 / 500). Thank you. Still no joy with the Pi.

One suggestion `And set the required app permissions`, it would probably be worth putting in that

```auto
files.content.write Edit content of your Dropbox files and folders
files.content.read View content of your Dropbox files and folders

```

should be ticked in the Permissions tab otherwise it doesn't work. May be obvious to some but I bet there are others like me who are not so sharp.

[Next page](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312.md?page=2)