search

ReticentJohn / Amaroq

A floofy Mastodon companion for iOS
https://appsto.re/us/OfFxib.i
Mozilla Public License 2.0
237 stars 56 forks source link

OAuth login isn't implemented correctly #49

Closed lambadalambda closed 7 years ago

lambadalambda commented 7 years ago

Amaroq uses a weird login scheme to get the access_token, logging in on a webview and then waiting for an access code to appear in the html. This isn't a valid oauth flow and will possibly break in the future if Mastodon changes it's html. Amaroq should probably implement the usual oauth token exchange mechanism.

I found the issue because Pleroma also implements the Mastodon API, but has different html, so it breaks there.

ReticentJohn commented 7 years ago

This is an unfortunate reality until the API provides access to the ability to alter account preferences. While admittedly strange, running this login method allows the app’s shared urlsession to retain cookies and continue to have access to parts of a Mastodon instance that would otherwise be unreachable by the API alone.

Perhaps to mitigate risk, the login should be upgraded to use the standard flow, and when accessing account preferences the user would just have to login again.

I’ll accept PR’s from anyone who wants to change Amaroq’s login process but I probably won’t do it myself until if/when it actually breaks on mastodon.social.

lambadalambda commented 7 years ago

Interesting! Thanks for the explanation!

zspencer commented 7 years ago

Not sure if this is the cause or not, but I've found that I cannot log in to mastodon.social?

It spins forever: https://zspencer.keybase.pub/IMG_3300.TRIM.mov

Not sure if there is a debug log bundle I can send to ya?

ReticentJohn commented 7 years ago

This is indeed the issue that has surfaced in v2 of Mastodon. The app will need to be reworked to use the proper oauth flow documented in Mastodon’s API and as a result, the Edit Profile and Account Preferences areas of the app will also need to boot the user off to Safari, instead of handling it in the app. (There is API available for edit profile now but that would require UI work on top of everything)

I will be getting to this as soon as I am able, but cannot say this’ll be fixed quickly. :(

moritzheiber commented 7 years ago

FYI, this is fixed in the latest TestFlight beta.

Fatima-yo commented 3 years ago

Hello people, I am getting this same error using Amaroq on iPhone Any hints will be highly appreciated