search

zmb3 / spotify

A Go wrapper for the Spotify Web API
Apache License 2.0
1.38k stars 291 forks source link

Is there support for PCKE in the Exchange() method? #129

Open andrewcretin opened 4 years ago

andrewcretin commented 4 years ago

I've started receiving errors saying 'invalid code_verifier' on the Exchange method. This worked fine before, but now I am unable to get a valid token from the code.

On the client I am not getting a code_verifier or any other params as apart of the callback url.

Any help is appreciated.

Thanks

oliveroneill commented 4 years ago

@andrewcretin Did you have any luck working this out? I'm stuck with the same error

andrewcretin commented 4 years ago

No luck yet. I tried debugging for a while, and couldn't find any updates in Spotify docs so left it until now. Will likely look again this week - surely others are experiencing the same

FrankMoreno commented 4 years ago

I'm working on getting this integrated, will hopefully have something in the next week.

brianstrauch commented 3 years ago

Old issue, but here's a working implementation of PKCE in a project of mine if anyone's interested. I solved the "invalid code_verifier" issue by trimming the trailing = from the base64url'd hash: https://github.com/brianstrauch/spotify-cli/blob/da00b4b776b5423b2f0dcdb9966f9d0ae73f68ae/pkg/auth.go#L25

elliotwms commented 1 year ago

Yes this is possible, there's a working example in examples/pkce however this doesn't demonstrate how to actually generate the verifier or the challenge.

I also got caught by the same invalid_code_verifier issue, which I solved by using RawURLEncoding which doesn't add the = padding. I wrote a pkce package in a recent project which solves this if anyone needs a reference implementation: https://github.com/elliotwms/opml-to-spotify/blob/4fa2b4c472083c3d19337af557d4afb61f6e0e88/pkg/pkce/pkce.go#L44-L49