search

NicolasConstant / sengi

Mastodon & Pleroma Multi-account Desktop Client
https://nicolasconstant.github.io/sengi/
GNU Affero General Public License v3.0
534 stars 35 forks source link

Sengi login prompts for Mastodon username and password instead of app OAuth API authentication token through an external browser? #566

Closed nekohayo closed 1 year ago

nekohayo commented 1 year ago

Hi there, I downloaded and executed the appimage version of Sengi out of curiosity, and when you try to add an account, after specifying the server, you get this login prompt:

image

That's quite different from other Mastodon clients I've tested so far, in that it asks for the user's password. Why not open the user's browser with a token request, to let the server handle the authorization of this app, wouldn't it be safer to only have some token that the server can revoke at will (including, for example, if the device is lost/stolen/etc.)?

I'm not technical enough to be able to help with code, but it seems this would be the relevant documentation on this topic: https://docs.joinmastodon.org/client/token/ and https://docs.joinmastodon.org/client/authorized/ and probably pages over there...

NicolasConstant commented 1 year ago

Hi!

Indeed it would be a very bad practice to ask for the login/password of the user, that's why Sengi also rely on the OAuth workflow and use the token after that. 😉

What you're seeing in the screen is the login page of your instance, the token is retrieved automatically after that. You can verify it by opening the console (Ctrl + Shift + I) or testing Sengi via its webapp. Also, after login you'll be able to see the issued token in your instance's settings panel. 🙂

nekohayo commented 1 year ago

Oh! I didn't know that was possible within the same app, even if it's (presumably) an electron app, I thought my normal web browser would open for this! So Sengi doesn't store passwords at all?

NicolasConstant commented 1 year ago

Sengi doesn't see your credentials at any moment at all. 🙂

Usually to host this in a more "desktop" app (a WPF .NET app for example) you will need to rely on an embedded browser, or do it externally of course, but it's a bit less user friendly, especially when you have to copy paste the resulting token.

The "desktop" version of Sengi is really only an Electron wrapper and is totally optional, I just provide it for people that like it.