ESP8266 has been able to get OAuth token by Device Flow OAuth2.0

After getting OAuth token, I was hitting the REST API endpoint /services/data/v45.0/sobjects/Account with a JSON body in the request:

HTTPSRedirect client;
client.setInsecure(); // does not validate Certificate of the server , this is needed as i do not want to store the fingerprint of the server as it changes  with certificate renewal
String access_token = (*tokenJSON)["access_token"].as<char*>();
String authorization_header_str = "OAuth " + access_token ;
const char* server = "ap8.lightning.force.com";
const char* host="ap8.lightning.force.com";  // Server URL 
client.connect(server, 443)
String url="/services/data/v45.0/sobjects/Account";
String data ="{\"Name\":\"Raja\"}"  ;
client.println("POST " + url + " HTTP/1.1");
client.println("Host: " + (String)host);
client.println("User-Agent: ESP8266/1.0");
client.println("Content-Type: application/json");
client.println("Authorization: "+authorization_header_str);
client.print("Content-Length: ");
String response = client.readString();

The response given back is as follows:

Connected to server!
HTTP/1.1 302 Found
Date: Sat, 16 Feb 2019 06:47:17 GMT
Strict-Transport-Security: max-age=31536001; includeSubDomains
Public-Key-Pins-Report-Only: pin sha256="9n0izTnSRF+W4W4JTq51avSXkWhQB8duS2bxVLfzXsY="; pin-    sha256="5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w="; pin-sha256="njN4rRG+22dNXAi+yb8e3UMypgzPUPHlv4+foULwl1g="; max-age=86400; includeSubDomains; report-uri="https://a.forcesslreports.com/hpkp-report/nullm";
Expect-CT: max-age=0; report-uri="https://a.forcesslreports.com/Expect-CT-report/nullm";
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: upgrade-insecure-requests  //// SEE THIS, it says to pgrade to https
X-Robots-Tag: none
Cache-Control: no-cache,must-revalidate,max-age=0,no-store,private
Set-Cookie: BrowserId=tlUX-F_cRg6EKM-qch5thw;Path=/;Domain=.force.com;Expires=Wed, 17-Apr-2019 06:47:17 GMT;Max-Age=5184000

Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://ap8.salesforce.com/services/data/v45.0/sobjects/Account
Content-Length: 0

So, how to solve this redirect problem?

It would be solved if :

  1. If I could get the certificate fingerprint of https://ap8.salesforce.com by some API call or from somewhere(dynamically)

  2. I can somehow upgrade the insecure https request to a secure https request

  3. Some how http to https proxy maybe?

  4. Take something from the response header and some how verify certificate?

Any help is greatly appreciated.


I had a similar issue and solved simply by substituting the server URL with the location indicated in the response

const char* server = "ap8.salesforce.com";
const char* host="ap8.salesforce.com";  // Server URL 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.