search

Marenthyu / smarttv-twitch

Twitch client for Samsung Smart TVs 2015 and newer models, in doubt read the README bellow
GNU General Public License v3.0
2 stars 0 forks source link

Replace Client-Side Authentication Code Flow with Implicit Flow #2

Open Marenthyu opened 2 years ago

Marenthyu commented 2 years ago

As has been brought up multiple times (but comments deleted, see #1 ), the project currently exposes its Client Secret due to utilizing the Authorization Code Flow on the client side.

This shall be replaced by an Implicit Flow, which can be handled on a GitHub Pages Page, assuming the Client is configured accordingly on the Twitch Console.

I will provide the necessary Code to facilitate the Authentication on the GitHub Pages page, but leave it up to others to provide additionally required code changes to store the token directly instead of accepting other input (and exchanging a code for a token clientside).

Last but not least @fgl27 owns the original project this was forked from and they will need to adjust the Twitch Client on their Console, which nobody else has access to. Specifically, the proper Redirect URL will need to be added for the exchange to work. Also, I will be unable to create a Pull Request to the Original Repository due to the original Author blocking me on GitHub, so I will leave it in the capable hands of someone else.

Marenthyu commented 2 years ago

Correction: The Repo already contains such a page, but uses the code flow, so no actual change of the redirect URL will be required on the Console.

Marenthyu commented 2 years ago

3dcc4b2f60cf42bc2608b53ea17a1e1a0b2e8f79

Marenthyu commented 2 years ago

The remaining required changes should be around https://github.com/Marenthyu/smarttv-twitch/blob/master/app/specific/AddCode.js#L261 - since that is where the access token is being stored.

The logic around Refresh Tokens will have to be removed as we do not get one with the implicit flow.

Whilst I didn't exactly have to do much to change the flow, I'd appreciate if someone else tried doing the remaining changes and verify that they work :)