# Input needed for a fix in the dropbox node (refresh tokens)
**URL:** https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949
**Category:** Developing Nodes
**Created:** [30 December 2022 11:04 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949 "2022-12-30T11:04:51Z")
**Posts on this page:** 20
**Page:** 2
### Author:  [@Buckskin](https://discourse.nodered.org/u/Buckskin)
#### Post date: [3 January 2023 21:45 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/21 "2023-01-03T21:45:04Z")
> [@BartButenaers](#):
>
> So when you want to request a new refresh token, you will have to get the App Key again from your Dropbox account
Not a problem for me because I save all that kind of stuff in my password manager
Does the OAuth stuff need to be in the frontend?
All the security stuff - over my head I'm afraid. If I have simple examples I can follow along & implement, but other than that ...
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [3 January 2023 21:52 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/22 "2023-01-03T21:52:30Z")
> [@Buckskin](#):
>
> Does the OAuth stuff need to be in the frontend?
Yes you need to call the authentication flow from your node's config screen, and then Dropbox will show a few pages where you need to confirm that this Node-RED node is allowed to access your Dropbox folders. The communication to dropbox is of course SSL. So it is better if I add a bit more code to the frontend, to calculate the authentication url also there. Then I don't need to send anything to Node-RED. Of course the resulting refresh token will be send - as a credential - to Node-RED. Don't know if that can be intercepted. But that is again application level stuff, not specific to this Dropbox node.
> [@Buckskin](#):
>
> All the security stuff - over my head I'm afraid.
That is no problem! I am already glad that there was some response. By thinking out loud to answer the questions, things became more clear.
Would be a shame if I introduce a security leak, while only trying to help some folks in this community...
I think I know enough for now, to continue the development.
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [3 January 2023 21:57 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/23 "2023-01-03T21:57:06Z")
> [@BartButenaers](#):
>
> I think I know enough for now, to continue the development.
Although one more question.
If I add a third-party code snippet to a semi-core node like this, does anybody know which licence it should have? For example found another sha256 implementation [here](https://www.movable-type.co.uk/scripts/sha256.html), which has an _ **MIT license** _. Is that ok to include? Perhaps something that @dceejay knows?
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [3 January 2023 23:25 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/24 "2023-01-03T23:25:46Z")
IANAL but I think either MIT or Apache2 should be fine, as long as attributed correctly.
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [5 January 2023 22:01 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/25 "2023-01-05T22:01:06Z")
> [@dceejay](#):
>
> IANAL
Oh my apologies. My mistake! By looking at your profile picture I was so certain you were one π
> [@BartButenaers](#):
>
> I think I know enough for now, to continue the development.
**I got something working, both with and without SSL** (towards Node-RED) πΎ π₯ π₯³ π
But don't panic: towards Dropbox it is always SSL π
- When SSL is used between the flow editor and Node-RED, then I generate the SHA256 hash with the browser's Crypto Web API. Because such a hash function implementation is reviewed by experts and probably more secure.
- When plain http is being used between the flow editor and Node-RED, then I generate the SHA256 hash with [this](https://github.com/emn178/js-sha256) implementation. Tried some others but failed to get the correct output format. That file is stored in a "resources" subfolder of the dropbox nodes, which is a standard [way](https://nodered.org/docs/creating-nodes/resources) of working in Node-RED:
I have now removed my last endpoint in the dropbox node, which means that no data is being communicated anymore with Node-RED. I have implemented instead the logic of the Dropbox SDK [generatePKCECodes](https://github.com/dropbox/dropbox-sdk-js/blob/main/src/auth.js#L198) inside the frontend (i.e. code verifier and code challenge calculations), so I could compose the Dropbox authentication URL myself. By removing the communication with Node-RED, I can now support both http and https traffic. Summarized:
So the only crypto data send to Node-RED (via http or https) is the refresh token at the end, to store it in Node-RED as a credential. I assume that people only use http behind a firewall. If people use this across a WAN over the internet, then I cannot help it if their refresh token gets intercepted (between their flow editor and Node-RED)...
The codebase has become very short and clean. I am very pleased with the result.
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [5 January 2023 22:39 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/26 "2023-01-05T22:39:45Z")
BTW I have to be honest. Have been searching like a maniac the last two evenings, why Dropbox kept complaining about _ **"invalid code identifier"** _. There was tiny difference between my code challenge calculation and how Dropbox calculates it. Dropbox calculates the challenge again and it must be exactly the same as mine. In my previous version I used their Javascript SDK in my endpoint, so then it was always correct. But not now that I calculate it by myself.
An hour ago I was getting desperate, and then I thought: perhaps I can ask it to the OpenAi chatbot. And I have to admit that (s)he provided me with the missing puzzle piece...
---
### Author:  [@tve](https://discourse.nodered.org/u/tve)
#### Post date: [5 January 2023 23:16 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/27 "2023-01-05T23:16:49Z")
what did you ask and what was the reply?
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [6 January 2023 05:58 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/28 "2023-01-06T05:58:30Z")
Don't ask me. I have already forgotten π
This was really too much detailed stuff after a hard dat at work. By typing the questions in my brain here and reading the doubts from other people, I finally came to a solution that I "think" is safe enough. I have tested it both on http and https.
It has become a very cryptic discussion, but it helped π
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [6 January 2023 06:01 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/29 "2023-01-06T06:01:33Z")
Ah now I see. You wondered what I have asked the chatbot and not what I have asked you people here. Seems I am not awake yet π€£
Will share it later on the day with you.
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [6 January 2023 06:51 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/30 "2023-01-06T06:51:18Z")
About my questions I have asked to the OpenAi chatbot:
Owkay, the problem was that in an unsecure context (i.e. I was in the config screen of a flow editor that was connected to Node-RED via plain HTTP) the Web Crypto API has no digest function to calculate a SHA256 hash. Had already tried some other libraries to calculate such a hash in my browser, but the output was most of time already converted to a string. And the Web Crypto digest function returned me an arraybuffer, which was also converted by the dropbox SDK to a string. But the Dropbox SDK returned another string.
1. I first asked him/her _"Give a javascript alternative to crypto.subtle.digest to create an sha256 hash"_. But that didn't work because he didn't understand "alternative", so he showed an example with the crypto.subtle.digest function (which I don't have).
2. Then I asked him/her _"give a javascript program to create an sha256 hash in the browser without using the crypto web api"_, but I was not sure whether his alternative would work because he was telling that it somehow used the Web Crypto API under the hood...
3. Then I asked him/her _"give a javascript program to create an sha256 hash in the browser when in a not secure environment"_. And now he gave me clear instructions which library I needed to use and a code example.
Of course you still need to know what you are doing and give him good questions. But it really helps. Although I like it, I am very sure that it will be misabused by some people in the future. But please let's not discuss that here π
BTW I have to admit that first I wrote 3 times in my post _"I asked him"_ instead of _"I asked her"_. So although I am really a guy that likes equality between woman and man, somehow my brain thought that the OpenAi bot was male βΊ. So my sincere apologies to all the ladies on this blue planet for me thinking that a chatbot with high quality technical answers can only be male.
Ok hopefully the ladies accept my apologies. Although I wonder if any of them will ever read a cryptic technical discussion like this. Damn now my brain did it again π π€£
---
### Author:  [@tve](https://discourse.nodered.org/u/tve)
#### Post date: [6 January 2023 08:06 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/31 "2023-01-06T08:06:31Z")
English has the convenient "it" π
---
### Author:  [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)
#### Post date: [6 January 2023 10:30 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/32 "2023-01-06T10:30:11Z")
Definitely an 'it' π
---
### Author:  [@dceejay](https://discourse.nodered.org/u/dceejay)
#### Post date: [6 January 2023 11:24 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/33 "2023-01-06T11:24:35Z")
Ask it what it's pronouns are...
---
### Author:  [@hotNipi](https://discourse.nodered.org/u/hotNipi)
#### Post date: [6 January 2023 11:42 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/34 "2023-01-06T11:42:14Z")
... your profile image
---
### Author:  [@Paul-Reed](https://discourse.nodered.org/u/Paul-Reed)
#### Post date: [6 January 2023 11:47 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/35 "2023-01-06T11:47:08Z")
> [@dceejay](#):
>
> Ask it what it's pronouns are
There's too many letters to type in 'Assistant'...
---
### Author:  [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)
#### Post date: [6 January 2023 11:54 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/36 "2023-01-06T11:54:48Z")
I think you can safely shorten it to just 3 letters! π
---
### Author:  [@hotNipi](https://discourse.nodered.org/u/hotNipi)
#### Post date: [6 January 2023 12:03 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/37 "2023-01-06T12:03:19Z")
"sis" then. Definitely she π
---
### Author:  [@hotNipi](https://discourse.nodered.org/u/hotNipi)
#### Post date: [6 January 2023 12:10 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/38 "2023-01-06T12:10:22Z")
Mystery solved. "Photo of the mirror in front of you"
---
### Author:  [@BartButenaers](https://discourse.nodered.org/u/BartButenaers)
#### Post date: [6 January 2023 22:06 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/39 "2023-01-06T22:06:50Z")
The pull request has been submitted.
Announcement started in another discussion:
> [@\[ANNOUNCEMENT\] Dropbox node versie 2.1.0 (beta) - refresh token refactored](https://discourse.nodered.org/t/announcement-dropbox-node-versie-2-1-0-beta-refresh-token-refactored/73312):
>
> Hi folks, We introduced in version 2.0.0 of the dropbox node the concept of refresh tokens, to allow this node to support the new stronger Dropbox security guidelines. However our mechanism was based on OAauth2 redirect url's, which required the connection between Node-RED and the flow editor to be SSL with certificates signed by a trusted CA (e.g. LetsEncrypt). Normally it is bad practice to use plain HTTP, however when everything (flow editor, Node-RED, ...) is located in a secure LAN behinβ¦
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [7 March 2023 22:07 UTC](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949/40 "2023-03-07T22:07:09Z")
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.
[Previous page](https://discourse.nodered.org/t/input-needed-for-a-fix-in-the-dropbox-node-refresh-tokens/72949.md?page=1)