search

quadule / knobby

A little Spotify remote to remind you that there's a lot of music out there.
MIT License
173 stars 14 forks source link

Switch to PKCE authorization #2

Closed quadule closed 3 years ago

quadule commented 4 years ago

This should eliminate the need to compile in the client_secret and make it possible to release a firmware binary.

https://developer.spotify.com/documentation/general/guides/authorization-guide/#authorization-code-flow-with-proof-key-for-code-exchange-pkce

quadule commented 3 years ago

I have this implemented in https://github.com/quadule/knobby/tree/pkce but am not sure if I want to merge it. Spotify's PKCE implementation revokes the old refresh_token whenever fetching an access_token which complicates things slightly: If a network or device glitch ever prevents the updated refresh_token from being saved, the user would have to re-authenticate in a browser. This is also annoying when testing the software because it prevents sharing of tokens between devices.