Support PKCE oauth flow

[anatosun]

It would be handy to have a dedicated spotify client and secret rather than having each user make one.

[jbh-cloud]

@fwicht to confirm, you are wanting spotify_sync to have a global client that you authorize permission to read your Spotify account with?

Unless I'm missing something, that would mean there is a client id and secret, publicly available in the repo that has access to every user that has authorized it. That would be a massive data breach for other users.

[anatosun]

That's what I meant indeed and of course in the current state, providing the id and secret would imply a security breach. For this very purpose, Spotify recommends using a different authorisation flow in their documentation:

In scenarios where storing the client secret is not safe (e.g. desktop, mobile apps or JavaScript web apps running in the browser), you can use the authorization code with PKCE, as it provides protection against attacks where the authorization code may be intercepted.

Yet, I don't know how feasible it is in this very instance.

[jbh-cloud]

Interesting, I wasn't aware of PKCE. I will have a look to see how it may work in this context.

[jbh-cloud]

@fwicht in-order to setup PKCE i need to create a new oauth application that people will authorize against. By default the app status is created as 'Development Mode' which will only allow up-to 25 people to authorize against it.

You can apply for a quota extension, but I don't think this will likely be accepted. Requirements below:

[anatosun]

You think that due to the first point (significant user-base) the application will not be accepted?

[jbh-cloud]

Yes, partly because of user base and also I dont' think they're going to want to onboard an application that is claiming to download spotify songs, even if it ultimately doesn't come from Spotify

[anatosun]

Yes, I agree with you on this. Yet, I wonder how the devs of Lidarr have managed to have the quota extension. (They do have the user base though)

[jbh-cloud]

I think Lidarr (as with all the *arr suite) can argue its a media management product,

I'm going to close this down, if it becomes easier in the future I will reopen

[jbh-cloud]

@fwicht this is now supported in 1.1.0, see FAQ in docs

[Shabinder]

@jbh-cloud gr8,
may I ask if you are comfortable with sharing your extension request, and how much time it took, any insights would be gr8.