librespot-org / librespot-org/librespot

`get_token` fails using credentials obtained through FB auth flow

Open
#754 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

reverse engineering
Dominant language
Rust
Stars
7.2k
Forks
888
Avg merge
6h 41m
Merged PRs (30d)
3

Description

I have credentials through a modified version of https://github.com/hrkfdn/ncspot/pull/537 that uses a newly created client id and client secret (CLIENT_ID from here on out). These credentials authenticate:

[2021-05-24][14:45:53] [librespot_core::session] [INFO] Authenticated as "##########" !
[2021-05-24][14:45:53] [librespot_playback::audio_backend::pulseaudio] [INFO] Using PulseAudio sink with format: S16
[2021-05-24][14:45:53] [librespot_core::session] [INFO] Country: "DE"

However librespot is unable to get a token using these credentials:

[2021-05-24][14:45:53] [librespot_core::mercury] [WARN] error 403 for uri hm://keymaster/token/authenticated?client_id=CLIENT_ID&scope=user-read-private,playlist-read-private,playlist-read-collaborative,playlist-modify-public,playlist-modify-private,user-follow-modify,user-follow-read,user-library-read,user-library-modify,user-top-read,user-read-recently-played

I have a hacked up version of examples/get_token.rs that works off of these credentials instead of whats passed on the command line (see https://github.com/medwards/librespot/commit/fed29f4ceca9d4fedf49f251b1b7d9a0cdc74ed2).

This works for the streaming scope:

~/forks/librespot$ cargo run --package librespot --example get_token -- /home/medwards/.cache/ncspot/librespot CLIENT_ID streaming
    Finished dev [unoptimized + debuginfo] target(s) in 0.06s
     Running `target/debug/examples/get_token /home/medwards/.cache/ncspot/librespot CLIENT_ID streaming`
Connecting..
Token: Token {
    access_token: "AN_ACCESS_TOKEN",
    expires_in: 3600,
    token_type: "Bearer",
    scope: [
        "streaming",
    ],
}

For any other scope or combination of scopes I get MecuryError.

~/forks/librespot$ cargo run --package librespot --example get_token -- /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-modify
    Finished dev [unoptimized + debuginfo] target(s) in 0.06s
     Running `target/debug/examples/get_token /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-modify`
Connecting..
 Got error: MercuryError
~/forks/librespot$ cargo run --package librespot --example get_token -- /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-read
    Finished dev [unoptimized + debuginfo] target(s) in 0.06s
     Running `target/debug/examples/get_token /home/medwards/.cache/ncspot/librespot CLIENT_ID playlist-read`
Connecting..
 Got error: MercuryError

I originally requested the following scopes when going through the oauth2 flow so I expect these to work (and mysteriously streaming does):

                  "app-remote-control",
                  "playlist-modify",
                  "playlist-modify-private",
                  "playlist-modify-public",
                  "playlist-read",
                  "playlist-read-collaborative",
                  "playlist-read-private",
                  "streaming",
                  "user-follow-modify",
                  "user-follow-read",
                  "user-library-modify",
                  "user-library-read",
                  "user-modify",
                  "user-read-private",
                  "user-read-recently-played",
                  "user-top-read",

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with examples/get_token.rs and reproduce the successful streaming request alongside the failing playlist scopes using the commands in the report. Trace the authentication request to the hm://keymaster/token/authenticated endpoint and compare the requested scopes with the 403 response. Done means the reported scopes either return a token or their unsupported behavior is clearly surfaced and covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
api, authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.