Skip to content
This repository was archived by the owner on Nov 3, 2023. It is now read-only.

AUTHORIZATION.md

Latest commit

 

History

History
25 lines (19 loc) · 1.54 KB

AUTHORIZATION.md

File metadata and controls

25 lines (19 loc) · 1.54 KB
Raw

AUTHORIZATION

My strategies for implementing authorization

Custom authorization strategy

  1. User creates a custom Spotify application with the redirect URI of http://localhost. Application secret is not required.
  2. User authorizes themselves using this URL:
    https://accounts.spotify.com/authorize?client_id=(APPLICATION CLIENT ID HERE)&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A&scopes=user-read-playback-state%20user-modify-playback-state%20user-read-currently-playing
  3. User retrieves the OAuth2 code from the redirected http://localhost URI. (the code is placed right after the code query)
  4. User places the received OAuth2 code into an input (Needs to be secure. Perhaps we go the RepluggedPGP way)
  5. We retrieve the access token from the OAuth2 code.

What custom authorization means for us

  • We will no longer be bounded by Discord's Spotify access token's scope restrictions. Allows us to implement features (like / unlike tracks) that would otherwise be restricted by limited scopes.
  • Token reauthorization will be much simpler.

Internal plans

  • Provide a modal popout for generating authorization URLs
  • Provide a setting for adding the OAuth2 code
  • Handle both the Discord access token and the OAuth2 access token (by detecting the OAuth2 code's presence?)
  • Handle OAuth2 deauthorization by falling back to Discord's token