Can't authenticate user through XboxLive 400: Bad Request

Question

I'm trying to authenticate a user though XboxLive and I'm having some trouble I'm following this article and I cant get past the first step it always returns 400: Bad Request I did some digging and some people have said to put d= before the accessToken but this didn't help.

public void getXboxLiveToken() throws IOException{
        if (this.accessTokenJson == null) getAccessToken();

        Header[] headers = new Header[2];
        headers[0] = applicationJsonContentTypeHeader;
        headers[1] = applicationAcceptJsonHeader;

        HttpPost httpPost = new HttpPost(SIGNIN_XBL_URL);
        httpPost.setHeaders(headers);

        String jsonString = this.gson.toJson(new SignIntoXBLJson(this.accessTokenJson.getAccessToken()));
        StringEntity requestEntity = new StringEntity(jsonString, ContentType.APPLICATION_JSON);
        httpPost.setEntity(requestEntity);
        
        try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
            byte[] responseBytes = response.getEntity().getContent().readAllBytes();
            System.out.println(response.getStatusLine().getStatusCode() + ": " + response.getStatusLine().getReasonPhrase());
            System.out.println(new String(responseBytes));
        }
    }

Json

{
    "Properties": {
        "AuthMethod": "RPS",
        "SiteName": "user.auth.xboxlive.com",
        "RspTicket": "d=<Access Token>"
    },
    "ReplyingParty": "http://auth.xboxlive.com",
    "TokenType": "JWT"
}

Answer 1

It also took me some time to figure it out, but I ended up finding this article: Mojang API Documentation which sums it up quite well.

The request needs to be a 'POST' request with url https://user.auth.xboxlive.com/user/authenticate having the headers:

• Content-Type: application/json
• Accept: application/json

And with the following body:

{
    "Properties": {
        "AuthMethod": "RPS",
        "SiteName": "user.auth.xboxlive.com",
        "RpsTicket": "d=ACCESS_TOKEN_HERE" // access token you got from https://login.live.com/oauth20_token.srf
    },
    "RelyingParty": "http://auth.xboxlive.com",
    "TokenType": "JWT"
}

the result should be similar to this:

{
    "IssueInstant": "2022-10-30T01:45:49.8093136Z",
    "NotAfter": "2022-11-13T01:45:49.8093136Z",
    "Token": "TOKEN_HERE",
    "DisplayClaims": {
      "xui": [
         {
            "uhs": "USER_HASH"
         }
      ]
    }
}

The solution I ended up implementing look like this:

private String getXboxToken(String access_token) throws IOException {
            HttpResponse<JsonNode> xbox_response = Unirest.post("https://user.auth.xboxlive.com/user/authenticate")
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .body("{" +
            "    \"Properties\": {" +
            "        \"AuthMethod\": \"RPS\"," +
            "        \"SiteName\": \"user.auth.xboxlive.com\"," +
            "        \"RpsTicket\": \"d=" + access_token + "\"" + // token retrieved from https://login.live.com/oauth20_token.srf
            "    }," +
            "    \"RelyingParty\": \"http://auth.xboxlive.com\"," +
            "    \"TokenType\": \"JWT\"" +
            "}")
        .asJson();

    // checks for unsuccessful responses
    if (!xbox_response.isSuccess())
        throw new IOException("Couldn't get xbox token :" + xbox_response.getStatusText());

    // just prints the result
    System.out.println(xbox_response.getBody().toPrettyString());

    JSONObject obj = xbox_response.getBody().getObject();
    return (String) obj.get("Token");
}

I'm using the Unirest library which greatly simplifies the code