403 during token refresh only on docker

[barancezayirli]

Hi,

I have been following the guide for authentication.

• I manage to authenticate the user, get the access token and refresh the token. I do this by, letting users log in with the tesla auth URL themselves in the app, and get the tokens. This works even in deployed version as I am not calling the tesla auth from the server but from the client.
• I am refreshing the auth token before they expire in the server. This works in localhost.
• The problem comes when I deploy the server. Whenever I want to refresh the token, it fails with 403 error.

I use node js as server, dockerized, and deployed to a Kubernetes cluster.

Following the discussions here
I do think I have all the headers that I need, and I am making sure TLS is max 1.2
{ headers: { 'Content-Type': 'application/json', Accept: 'application/json', 'User-Agent': 'TeslaAuthJS/1.0', 'Keep-Alive': 'timeout=60000', }, agent: new https.Agent({ maxVersion: 'TLSv1.2', keepAlive: true, }), };

Anyone can give me some ideas?

[IMgoRt]

Running on NodeRed, I only have
"Content-Type": "application/json"

[Rockster160]

I'm getting a similar issue. localhost works fine. Live Rails production server gets 403 with the exact same code.

I have a SUPER hacky fix- I run a cron job locally every 6 hours that runs the refresh code and then POSTs the updated tokens to the live server which is used to actually connect and display the data.

Do you have another server you could try with a different ip or something? I figured it was some sort of ip ban for some reason.

[Urkman]

I have the same problem from an Ubuntu machine at Digital Ocean...

So I used a curl command to test the request:
curl --header "X-Forwarded-For: 1.2.3.4" -X POST https://auth.tesla.com/oauth2/v3/token -H "Authorization: Bearer {refresh_token}" -d "{body}" -H 'Content-Type: application/json' -A "ReqBin Curl Client/1.0"

Local MacBook: fine
Ubuntu Server @ DigitalOcean: error

Then I tested an other Server @ DigitalOcean (different ID) and this is also not working...

So, it seems, that the problem is not an IP ban...

Any other ideas?

[heumat]

The issue you face here is Digital Ocean. You can double check your DO IPs with Akamai, but once you migrate only this call to somewhere else, it will work. The change from DO to GCP works very well.
It is also just this call, so none of the others are affected (the vehicle endpoints).