Sending a direct message with a YouTube link results in "Could Not Authenticate You"

[BigZaphod]

I’m using “POST direct_messages/events/new” to send direct messages from our client, but if the message happens to contain a link to a youtube video, the post always fails with an error of: code = 32, message = “Could not authenticate you.”

Considering that sending other links in the messages work fine, this seems especially strange. Are people not allowed to DM links to youtube videos?

[andypiper]

Does this happen with all YouTube links? That does sound weird.

[BigZaphod]

Yeah, it seems like it - but only links to videos themselves. I can link to non-video youtube pages just fine. For example, attempting to send this link: “https://www.youtube.com/feed/trending” works fine. But this one will get the error: “https://www.youtube.com/watch?v=uVcvhKTVZ8g” (And so far, every video link I’ve tried gives me an error.)

[andypiper]

Ok. I’m not hearing yet of other apps being affected but this sounds like a potential false positive flag on YouTube URLs. Will escalate when I can.

[BigZaphod]

Ok, thanks! We’re getting quite a few reports of this from users, so it’s not just me personally.

[andypiper]

Understand!

[BigZaphod]

Update: After debugging this with one of our users, we narrowed it down to the equal sign. Any message with an = in it seems to fail - doesn’t even have to be a url. That seems kind of serious. I’m not sure if I’m encoding something wrong or if this a bug on your end, though.

[andypiper]

Ah. Yeah, that does not sound good.

If I remember correctly, I think I’ve seen this (or something similar to this) myself when using twurl to post the new JSON format body messages. I’ve got a couple of other things I need to work on this afternoon but I will try to reproduce and see if I can figure out what the encoding needs to be in that case.