title: Chrome extension / Oauth /Tumblr
body: <p>I am (trying to) implementing a Chrome Extension, that uses the Tumblr API. For that to work I need to authorize via OAuth (1.0a).</p>
  
  <p>I managed to get most of the authorization to work but I think I am missing something...</p>
  
  <p>My manifest.json of the Chrome Extension I am writing looks like this for now:</p>
  
  <pre><code>{
      "name": "Tumblr - Tiled Dashboard",
      "version": "0.1.1",
      "manifest_version": 2,
      "description": "This extension modifies the look of your Tumblr dashboard.",
      "icons": {
          "16": "images/icon_16.png",
          "48": "images/icon_48.png",
          "128": "images/icon_128.png"
      },
      "background": {
          "page": "background.html"
      },
      "content_scripts": [
          {
              "matches": [ "*://*.tumblr.com/dashboard" ],
              "css": [ "styles.css" ],
              "js": [ "jquery-2.1.3.min.js", "masonry.min.js", "code.js" ]
          }
      ],
      "permissions": [
          "https://www.google-analytics.com/",
          "https://api.tumblr.com/v2/*",
          "webRequest",
          "storage",
          "tabs",
          "https://www.google.com/accounts/OAuthGetRequestToken", "https://www.google.com/accounts/OAuthAuthorizeToken", "https://www.google.com/accounts/OAuthGetAccessToken"
      ],
      "web_accessible_resources": [ "chrome_ex_oauth.html", "injectedCode.js" ],
      "content_security_policy": "script-src 'self' https://api.tumblr.com/v2/ https://ssl.google-analytics.com; object-src 'self'",
      "homepage_url": "http://desvre.tumblr.com/",
      "author":  "Franz Spitaler"
  }
  </code></pre>
  
  <p>...I think this should be ok. In my background.html there are in fact only the included scripts (google analytics and the three oauth files I got from here: <a href="https://developer.chrome.com/extensions/tut_oauth" rel="nofollow">https://developer.chrome.com/extensions/tut_oauth</a> . Those three files are also included in the fourth file I downloaded from the previous source ("chrome_ex_oauth.html").</p>
  
  <p>Now when I reload the Chrome Extension in the Extensions (Ctrl + r) the Redirecting page opens and redirects me to the Tumblr authorization page, where I can allow the access.</p>
  
  <p>Since I also added the "chrome_ex_oauth.html" to the "web_accessible_resources" in the manifest.json this works.</p>
  
  <p>The problem occurs after the click on the 'allow' button. I simply get back to the redirecting page ("chrome_ex_oauth.html") and nothing more happens. When I open up the console, I can see an error message like the following:</p>
  
  <pre><code>GET https://www.tumblr.com/oauth/access_token?oauth_consumer_key=MY_CONSUMER_KEY&amp;oauth_nonce=D3VeV&amp;oauth_signature=kvhL%2F9GSMuiODoPR%2FyUrUiqzqF0%3D&amp;oauth_signature_method=HMAC-SHA1&amp;oauth_timestamp=1424250463&amp;oauth_token=6khqzjiMFbM7hcqqnNf8hm9ttDELKUVYo2TBQmyLOtepGN9KhJ&amp;oauth_verifier= 400 (Bad Request)
  </code></pre>
  
  <p>As described in the OAuth tutorial page from Google I use this to initialize the 'background page' (which leads to the error message):</p>
  
  <pre><code>var oauth = ChromeExOAuth.initBackgroundPage({
      'request_url': 'https://www.tumblr.com/oauth/request_token',
      'authorize_url': 'https://www.tumblr.com/oauth/authorize',
      'access_url': 'https://www.tumblr.com/oauth/access_token',
      'consumer_key': 'MY_CONSUMER_KEY',
      'consumer_secret': 'MY_SECRET_CONSUMER_KEY',
      'app_name': 'Tumblr Tiled Dashboard'
  });
  </code></pre>
  
  <p>Did I miss something important here? I think the manifest.json file is ok (permissions, web_accessible_resources?!).</p>
  
  <p>Thank you for any help. There is really no really great tutorial for OAuth out there for Google Extensions (except that linked page)...</p>