search

OpenXbox / xbox-webapi-python

A python library to authenticate with Xbox Live via your Microsoft Account and provides Xbox related Web-API.
https://pypi.python.org/pypi/xbox-webapi
MIT License
175 stars 44 forks source link

Screenshots endpoint not pulling in the latest content #57

Open nightsurge opened 3 years ago

nightsurge commented 3 years ago

As of March 13th, Microsoft implemented some sort of changes to their API which now prevents newly captured screenshots from being returned from the mediahub or screenshotsmetadata endpoints. I believe this is all down to changes in their authentication or Signed Requests flow.

Has signed requests been implemented and actually used in this project yet? Or has anyone had a chance to look into this? I believe the maintainer of XboxReplay-Auth/API has figured out a way to get the latest information, and I know he has posted here in the past as well.

nightsurge commented 3 years ago

@tuxuser can you clarify how to actually use the request signer in the current examples/flow? I am trying to integrate it, as it's not currently being used, but I think it is needed.

nightsurge commented 3 years ago

Are there any maintainers that have had a chance to look into this? Is there any guidance on how to use the SignedRequests logic? Sorry for pinging so many people, but I can see this being a huge blocker in the near future if all new content is locked behind AUTH level changes or SignedRequests.

@tuxuser @hunterjm @Nereg @fuyutsuki @JamesTheAwesomeDude @Landcross ?

JamesTheAwesomeDude commented 3 years ago

@nightsurge I'm not a maintainer, but I can tell you that the maintainers would appreciate if if you would help us help you on this request/report, such as:

tuxuser commented 3 years ago

It's not really a response that you would like or help the matter much, but current situation is the following:

To see request signing in action, check out the authentication route in https://github.com/OpenXbox/xcloud-python

Cheers

@JamesTheAwesomeDude thanks for hinting the proper direction how issues should be created :) appreciated!

nightsurge commented 3 years ago

@JamesTheAwesomeDude @tuxuser

For example, when getting the latest screenshots for my gamertag, NightSurgeX2 / xuid = 2674682457276710, the most recent one that appears is either Rocket League or Destiny 2 (depending on the contract version and how weird Xbox API is being that day). However, the REAL most recent screenshot I have is from Outriders, as evidenced when I use the official Xbox mobile app to view my captures. It only shows up on Official apps right now.

I now have hundreds of users reporting this to me, that their recent screenshots are not showing up, so it definitely is widespread, but so far only isolated to Screenshots. I believe the owner of the XboxReplay repo, which has made bugs/contributions to this project in the past, has it working on some new authentication layer that he is using. Perhaps he could shed some light on it for us?

https://github.com/XboxReplay/xboxlive-auth/tree/4.0.0 @alexis-bize

tuxuser commented 3 years ago

@nightsurge The code is there, look for something called auth - https://github.com/OpenXbox/xcloud-python

Alexis-Bize commented 3 years ago

👋 Right, xcloud-python has the correct scheme :) As said, I'm not sure that divulging the signing procedure is right as It may have a negative impact regarding user's security (or targeted games) if it's coupled with a custom Azure application on a non verified / partner website. My 2 cents though.

nightsurge commented 3 years ago

@Alexis-Bize I was able to get signing routine figured out, but it does appear that signing isn't the only piece. I also need to add the new overall authentication flow and I can't get past the part of requiring a manual entry and the auth via the browser. Has anyone figured out how to do this auth flow using their own Azure app config and get the updated auth tokens using Device, Title, and User/Access token when getting the final Xbox Live XSTS token?

Alexis-Bize commented 3 years ago

@nightsurge Right, I'm currently using it on HaloDotAPI services (Cryptum, Leaderboards, XUGC, etc.).

Note: The main issue with MediaHub (and *metadata endpoints) is that, even with a "signed" token, you won't be able to fetch other users' screenshots (clips are not impacted at the moment). Only the owner may retrieve them.

There's so many cases to handle so I'm using HaloDotAPI as a POC before implementing everything on XboxReplay.

nightsurge commented 3 years ago

@Alexis-Bize can we continue this conversation on Twitter DM, or can you send me your email/discord or something so we can chat further. I'm really interested to see the flow you used in order to get user sign on working.

I am aware of the issue with only the users' content being returned using the new auth/token, but that should not be a problem in my app/scenarios I am looking at going forward. I do have a verified Azure app and have many contacts within Microsoft/Xbox, but unfortunately none in the right place to find answers on these auth changes haha...

nightsurge commented 1 year ago

Is this resolved now?

tuxuser commented 1 year ago

No, not yet.