goatcorp / FFXIVQuickLauncher

Custom launcher for FFXIV
https://goatcorp.github.io/
GNU General Public License v3.0
2.85k stars 333 forks source link

Allow for XIVLauncher to be executed from a terminal for automatic login #982

Open Barbiero opened 2 years ago

Barbiero commented 2 years ago

Update disclaimer

What happened, what did not, what did you want to happen?

I've been experimenting with the Bitwarden CLI and I noticed I can get the TOTP(as well as user and password) programatically with an API key. In fact. I managed to write a pwsh script that hooks into the XIVLauncher OTPListener server.

I would be nice if we could execute XIVLauncher from the command line with flags like:

XIVLauncher.exe --username [SQUARE-ENIX-ACCOUNT-USERNAME] --passwordfile [PATH-TO-FILE-THAT-CONTAINS-PASSWORD] --totp [TOTP-STRING-TO-SEND-IMMEDIATELY]

notice that I mention a "passwordfile" flag rather than the password itself as I believe it would be more secure to store it in a read-only user-limited file rather than passing it through the cmd line directly.

An alternative would be to use specific environment variables(like XL_USERNAME and XL_PASSWORD) with a --totp flag.

These are all so that we don't actually need to use the otplistener server if we can automate our login flow with a CLI tool(like the bitwarden CLI above, but I bet there are other tools around).

Version

Both

Platform

Applies to all

proegssilb commented 1 year ago

I personally favor the environment variable approach, but there is utility in CLI flags/arguments too.

mandreko commented 9 months ago

I really like the idea of environment variables. I'd like to not include the actual sensitive strings in the command line, since those could be viewed and potentially stolen by an attacker.

In the meantime, to mitigate this issue for me, I did a pull request #1432 for BitWarden scripts to automate this process like the 1Password automation does. Maybe it can be a stopgap fix for most folks, until something is added directly into the launcher itself.