Skip to content

Commit

Permalink
Add Warning to SpotifyImplicitGrant.__init__ (#568)
Browse files Browse the repository at this point in the history
* Clean up namespace in SpotifyPKCE._get_auth_response_interactive

* Add Warning to SpotifyImplicitGrant.__init__

* Update changelog with addition of warning
  • Loading branch information
IdmFoundInHim authored Aug 30, 2020
1 parent df99eab commit d448d33
Show file tree
Hide file tree
Showing 2 changed files with 11 additions and 3 deletions.
2 changes: 2 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

- `SpotifyPKCE.parse_auth_response_url`, mirroring that method in
`SpotifyOAuth`
- `SpotifyImplicitGrant` warns of security considerations and recommends
`SpotifyPKCE`

### Fixed

Expand Down
12 changes: 9 additions & 3 deletions spotipy/oauth2.py
Original file line number Diff line number Diff line change
Expand Up @@ -385,7 +385,7 @@ def _get_auth_response_interactive(self, open_browser=True):
"Go to the following URL: {}\n"
"Enter the URL you were redirected to: ".format(url)
)
response = SpotifyOAuth._get_user_input(prompt)
response = self._get_user_input(prompt)
state, code = SpotifyOAuth.parse_auth_response_url(response)
if self.state is not None and self.state != state:
raise SpotifyStateError(self.state, state)
Expand Down Expand Up @@ -924,7 +924,7 @@ class SpotifyImplicitGrant(SpotifyAuthBase):
a client secret, redirect uri, and username. The user will need to
copy and paste a URI from the browser every hour.
Security Advisory
Security Warning
-----------------
The OAuth standard no longer recommends the Implicit Grant Flow for
client-side code. Spotify has implemented the OAuth-suggested PKCE
Expand Down Expand Up @@ -962,7 +962,7 @@ def __init__(self,
show_dialog=False):
""" Creates Auth Manager using the Implicit Grant flow
**See help(SpotifyImplictGrant) for Security Advisory**
**See help(SpotifyImplictGrant) for full Security Warning**
Parameters
----------
Expand All @@ -974,6 +974,12 @@ def __init__(self,
* username: Must be supplied or set as environment variable
* show_dialog: Interpreted as boolean
"""
logger.warning("The OAuth standard no longer recommends the Implicit "
"Grant Flow for client-side code. Use the SpotifyPKCE "
"auth manager instead of SpotifyImplicitGrant. For "
"more details and a guide to switching, see "
"help(SpotifyImplictGrant).")

self.client_id = client_id
self.redirect_uri = redirect_uri
self.state = state
Expand Down

0 comments on commit d448d33

Please sign in to comment.