Authentication suddenly failing

[Brent Simmons]

I'm getting widespread reports tonight that people can't login via NetNewsWire. I checked it out myself and have the same problem.

Calling /accounts/ClientLogin works perfectly. I get back a 200 status code and Auth, LSID, and SID strings.

Then I got to fetch the T token, via /reader/api/0/token, passing back SID via the Cookie header -- and I always get back a 403.

Other people seeing this? Any idea what's going on, or how to get back up and running?

-Brent

[Mihai Parparita]

Hi Brent,

This is an unintended change as part of a recent Reader push. We're
still investigating what changed and what (if anything) third-party
clients have to do. We'll let you know as soon as we have a solution.

Mihai

[Brent Simmons]

Thanks, Mihai.

I'm hoping, of course, that it'll just start working again. I don't mind making changes to apps, it's just that with iPhone apps there's a delay as they go through Apple's approval process.

-Brent

[Patrick Watson]

I've got the same issues from our users. Through my own
troubleshooting, it appears that the Google Reader API is suddenly
requiring a HSID string in addition to the normal SID requirement. I
have no idea what this HSID is or where I can get one. If anyone can
get find out, please post back here.

Thanks,
Patrick

[Patrick Watson]

Indeed. Our users are reporting the same issues. In my own experimentation, it seems that the API is now requiring a HSID string in addition to the typical SID string. What the HSID is or where it is obtained from, I couldn't tell you.

Patrick

[Nick Bradbury]

FWIW, FeedDemon customers are reporting similar problems.

Nick

[Brent Simmons]

I'm now hearing reports that it's working again for some people. It's working for me on one of my machines but not all, so I'm guessing a fix is being distributed. (Just guessing, though.)

-Brent

[Mihai Parparita]

Yep, we're mid-rollback of the change.

Mihai

On Mon, Feb 8, 2010 at 11:07 PM, Brent Simmons <bre...@newsgator.com> wrote:

[Brent Simmons]

Thanks, Mihai. If you'd like, in the future, I'd be more than happy to test third-party-client access against a staging server. I bet other folks on the list (if not everyone) would also be willing to help test.

I realize that it may be difficult to set up and all that. But I should volunteer anyway. :)

-Brent

[Mihai Parparita]

The rollback is complete, sorry for the trouble caused.

It would be useful to be able to test third-party clients against our
internal staging servers. I was hoping for a preference key that I
could set to change the API host from www.google.com to another
domain, does such a thing exist in NNW?

Mihai

[Brent Simmons]

It doesn't exist -- but I can certainly make that happen. I've added that to the list for the next release. Thanks, Mihai.

-Brent

[Mariano Kamp]

It seems I slept through the crisis. Quite a splash the most recent
login issue made.

I would also love to be part of a test against a staging server. Not
sure what you mean with preference. I can configure the host as I use
the mechanism for the http/https distinction.

Btw. the ClientLogin documentation says that "Auth" should be used and
"SID"/"LSID" should be left alone. Any change the GR API would use
"Auth" in the future? This seems to be supported by the offical
Android Authentication API.

On Feb 9, 5:40 am, Brent Simmons <bre...@newsgator.com> wrote:
> It doesn't exist -- but I can certainly make that happen. I've added that to the list for the next release. Thanks, Mihai.
>
> -Brent
>
> On Feb 8, 2010, at 8:39 PM, Mihai Parparita wrote:
>
>
>
> > The rollback is complete, sorry for the trouble caused.
>
> > It would be useful to be able to test third-party clients against our
> > internal staging servers. I was hoping for a preference key that I

> > could set to change the API host fromwww.google.comto another