{"record":{"id":"406ea72a18dcf8fb","repo":"benweet/stackedit","slug":"dropbox-account-id-not-expected","errorCode":null,"errorMessage":"Dropbox account ID not expected.","messagePattern":"Dropbox account ID not expected\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"src/services/providers/helpers/dropboxHelper.js","lineNumber":86,"sourceCode":"        response_type: 'token',\n      },\n      silent,\n    );\n\n    // Call the user info endpoint\n    const { body } = await request({ accessToken }, {\n      method: 'POST',\n      url: 'https://api.dropboxapi.com/2/users/get_current_account',\n    });\n    userSvc.addUserInfo({\n      id: `${subPrefix}:${body.account_id}`,\n      name: body.name.display_name,\n      imageUrl: body.profile_photo_url || '',\n    });\n\n    // Check the returned sub consistency\n    if (sub && `${body.account_id}` !== sub) {\n      throw new Error('Dropbox account ID not expected.');\n    }\n\n    // Build token object including scopes and sub\n    const token = {\n      accessToken,\n      name: body.name.display_name,\n      sub: `${body.account_id}`,\n      fullAccess,\n    };\n\n    // Add token to dropbox tokens\n    store.dispatch('data/addDropboxToken', token);\n    return token;\n  },\n  async addAccount(fullAccess = false) {\n    const token = await this.startOauth2(fullAccess);\n    badgeSvc.addBadge('addDropboxAccount');\n    return token;","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/benweet/stackedit/blob/6dce2a5e36b755a0c244522b48a06c91a2df0f59/src/services/providers/helpers/dropboxHelper.js#L68-L104","documentation":"After a Dropbox OAuth2 exchange, startOauth2 compares the Dropbox account_id returned by the API with the `sub` claim embedded in the issued app token. A mismatch means the account that completed authorization is not the account the token was issued for, so dropboxHelper throws at src/services/providers/helpers/dropboxHelper.js:86 to prevent storing credentials for the wrong identity.","triggerScenarios":"`${body.account_id}` !== sub during startOauth2: the OAuth token's sub does not match the account_id from the Dropbox profile call — e.g. the user switched Dropbox accounts between token issuance and authorization, or a stale/cached token sub was reused.","commonSituations":"User has multiple Dropbox accounts and the browser session lands on a different one; re-auth flow reusing an old token's sub with a new account's login; cookie/session mixups in shared browsers.","solutions":["Log out of other Dropbox accounts (or use a private window) and reconnect so the same account completes authorization.","Clear stored tokens for the provider and restart the OAuth flow from scratch.","Ensure the `sub` passed to startOauth2 comes from the same token exchange, not a stale saved token.","Retry the sign-in flow; if it persists, check for proxy/session rewriting of the OAuth response."],"exampleFix":"// before\nif (sub && `${body.account_id}` !== sub) {\n  throw new Error('Dropbox account ID not expected.');\n}\n// after\nif (sub && `${body.account_id}` !== sub) {\n  console.warn(`Dropbox account mismatch: expected ${sub}, got ${body.account_id}`);\n  throw new Error(`Dropbox account ID not expected (authorized ${body.account_id}, expected ${sub}). Sign in with the correct account.`);\n}","handlingStrategy":"try-catch","validationCode":"function storedSubMatches(expectedSub) {\n  const saved = readSavedProviderToken('dropbox');\n  return !saved || !saved.sub || saved.sub === expectedSub;\n}","typeGuard":"function isDropboxAccountMismatch(err) {\n  return err instanceof Error && /account ID not expected/i.test(err.message);\n}","tryCatchPattern":"try {\n  await dropboxHelper.startOauth2(...);\n} catch (err) {\n  if (isDropboxAccountMismatch(err)) {\n    clearStoredTokens('dropbox');\n    promptReauthInFreshSession();\n  }\n}","preventionTips":["Sign in with only one Dropbox account (or use a private window) when connecting.","Clear cached provider tokens before re-running OAuth after account changes.","Never reuse a token's sub with a new authorization flow.","Log both account ids on mismatch to help users identify the wrong account."],"tags":["oauth","dropbox","account-mismatch"],"backgroundTag":"oauth-account-mismatch","analyzedSha":"6dce2a5e36b755a0c244522b48a06c91a2df0f59","analyzedAt":"2026-09-01T00:49:23.866Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T05:18:18.240Z"}