2 Legged Authorization Failure on Locked Down Network - autodesk-forge

Question

I am very new to Forge and we are trying to run the tutorial on our work network.
Our network is very locked down so I have had to get the ‘developer.api.autodesk.com’ to the Cisco HTTPS Exceptions list.
Is there any other pages I need to add to get the 2 legged Authorization working.
When I click on 'Authorize Me' button on the local host I get 'Failed to Authorize' show up on the web page.
The report I get back on the node.js command prompt is as below (Client ID etc changed)
Any help appreciated.
> viewer-walkthrough-online.viewer#2.0.0 start C:\APA_Testing\Forge\walkthrough
> node start.js
Server listening on port 3000
{ Error: unable to get local issuer certificate
at TLSSocket.onConnectSecure (_tls_wrap.js:1058:34)
at TLSSocket.emit (events.js:198:13)
at TLSSocket._finishInit (_tls_wrap.js:636:8)
code: 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
config:
{ adapter: [Function: httpAdapter],
transformRequest: { '0': [Function: transformRequest] },
transformResponse: { '0': [Function: transformResponse] },
timeout: 0,
xsrfCookieName: 'XSRF-TOKEN',
xsrfHeaderName: 'X-XSRF-TOKEN',
maxContentLength: -1,
validateStatus: [Function: validateStatus],
headers:
{ Accept: 'application/json, text/plain, */*',
'Content-Type': 'application/x-www-form-urlencoded',
'User-Agent': 'axios/0.18.1',
'Content-Length': 186 },
method: 'post',
url:
'https://developer.api.autodesk.com/authentication/v1/authenticate',
data:
'client_id=XXXXXXXXXXXXXXXX&client_secret=XXXXXXXXXX&grant_type=client_credentials&scope=data%3Aread%20data%3Awrite%20data%3Acreate%20bucket%3Acreate%20bucket%3Aread' },
request:
Writable {
_writableState:
WritableState {
objectMode: false,
highWaterMark: 16384,
finalCalled: false,
needDrain: false,
ending: false,
ended: false,
finished: false,
destroyed: false,
decodeStrings: true,
defaultEncoding: 'utf8',
length: 0,
writing: false,
corked: 0,
sync: true,
bufferProcessing: false,
onwrite: [Function: bound onwrite],
writecb: null,
writelen: 0,
bufferedRequest: null,
lastBufferedRequest: null,
pendingcb: 0,
prefinished: false,
errorEmitted: false,
emitClose: true,
autoDestroy: false,
bufferedRequestCount: 0,
corkedRequestsFree: [Object] },
writable: true,
_events:
[Object: null prototype] {
response: [Function: handleResponse],
error: [Function: handleRequestError] },
_eventsCount: 2,
_maxListeners: undefined,
_options:
{ protocol: 'https:',
maxRedirects: 21,
maxBodyLength: 10485760,
path: '/authentication/v1/authenticate',
method: 'post',
headers: [Object],
agent: undefined,
auth: undefined,
hostname: 'developer.api.autodesk.com',
port: null,
nativeProtocols: [Object],
pathname: '/authentication/v1/authenticate' },
_redirectCount: 0,
_redirects: [],
_requestBodyLength: 186,
_requestBodyBuffers: [ [Object] ],
_onNativeResponse: [Function],
_currentRequest:
ClientRequest {
_events: [Object],
_eventsCount: 6,
_maxListeners: undefined,
output: [],
outputEncodings: [],
outputCallbacks: [],
outputSize: 0,
writable: true,
_last: true,
chunkedEncoding: false,
shouldKeepAlive: false,
useChunkedEncodingByDefault: true,
sendDate: false,
_removedConnection: false,
_removedContLen: false,
_removedTE: false,
_contentLength: null,
_hasBody: true,
_trailer: '',
finished: false,
_headerSent: true,
socket: [TLSSocket],
connection: [TLSSocket],
_header:
'POST /authentication/v1/authenticate HTTP/1.1\r\nAccept: application/json, text/plain, */*\r\nContent-Type: application/x-www-form-urlencoded\r\nUser-Agent: axios/0.18.1\r\nContent-Length: 186\r\nHost: developer.api.autodesk.com\r\nConnection: close\r\n\r\n',
_onPendingData: [Function: noopPendingOutput],
agent: [Agent],
socketPath: undefined,
timeout: undefined,
method: 'POST',
path: '/authentication/v1/authenticate',
_ended: false,
res: null,
aborted: undefined,
timeoutCb: null,
upgradeOrConnect: false,
parser: null,
maxHeadersCount: null,
_redirectable: [Circular],
[Symbol(isCorked)]: false,
[Symbol(outHeadersKey)]: [Object] },
_currentUrl:
'https://developer.api.autodesk.com/authentication/v1/authenticate' },
response: undefined }

Answer 1

The only host you need to whitelist is developer.api.autodesk.com - all our endpoints are on this domain.
Actually the error is complaining about not being able to locate the SSL certificates that should be present in your local vault to verify the connections - test if the error persists if you use tools like cURL/Postman to call our APIs and ask your network administrator for help on this.
As a temporary workaround absolutely not recommended due for security reasons you can disable check for SSL issues following here - simply add the code to the Axios config in start.js