search

tomahawk-player / tomahawk-resolvers

Resolver plugins for Tomahawk Player
216 stars 114 forks source link

Amazon Resolver - Cannot login with 2FA enabled #130

Open HelmicNewciv opened 7 years ago

HelmicNewciv commented 7 years ago

Using the master branch of Tomahawk and tested with both the bundled and .10 .axe version of the Amazon resolver.

17:04:39 [0]: JAVASCRIPT: "/home/helmic/.local/share/Tomahawk/atticaresolvers/amazon/contents/code/amazon.js" : "Amazon Music failed login: {\"stack\":\"\\nlib$rsvp$$internal$$tryCatch\\nlib$rsvp$$internal$$invokeCallback\\nlib$rsvp$$internal$$publish\\nlib$rsvp$asap$$flush\",\"line\":441}"

This is after using an app password as detailed here (https://www.amazon.com/gp/help/customer/display.html?nodeId=201962400). I log in once as instructed, get a wrong password message, then append the security code to the end of the password and it successfully logs in. However, song searches fail:

17:09:14 [0]: JAVASCRIPT: "/home/helmic/.local/share/Tomahawk/atticaresolvers/amazon/contents/code/amazon.js:221" "Error: Failed login, cannot search." "undefined"

The only way it seems to log into Amazon Music and successfully get results seems to be to disable 2FA and then use the regular password.

theli-ua commented 7 years ago

I can take a look at it, but the way resolver is written atm is - it logs in each time resolver is loaded (eg on tomahawk start) so not sure how usable that would be with 2fa

HelmicNewciv commented 7 years ago

Just guessing here, but would it be possible to just separate the password and 2FA box, have the user enter the 2FA code if they have it, combine them when logging in for the first time, and ask the site to not require 2FA on this device? Then the regular password can be used, or whatever Amazon's API has set up for third party applications.

I imagine Amazon has some way of handling third party applications as they already have a method for logging in for older applications that don't support 2FA, so I'm certain using the app password for every login is not how you're expected to do it.