{"action":"created","issue":{"url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/issues/104","repository_url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET","labels_url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/issues/104/labels{/name}","comments_url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/issues/104/comments","events_url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/issues/104/events","html_url":"https://github.com/JohnnyCrazy/SpotifyAPI-NET/issues/104","id":175104144,"number":104,"title":"SpotifyWebAPI rewrite/redesign","user":{"login":"JohnnyCrazy","id":3109892,"avatar_url":"https://avatars.githubusercontent.com/u/3109892?v=3","gravatar_id":"","url":"https://api.github.com/users/JohnnyCrazy","html_url":"https://github.com/JohnnyCrazy","followers_url":"https://api.github.com/users/JohnnyCrazy/followers","following_url":"https://api.github.com/users/JohnnyCrazy/following{/other_user}","gists_url":"https://api.github.com/users/JohnnyCrazy/gists{/gist_id}","starred_url":"https://api.github.com/users/JohnnyCrazy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JohnnyCrazy/subscriptions","organizations_url":"https://api.github.com/users/JohnnyCrazy/orgs","repos_url":"https://api.github.com/users/JohnnyCrazy/repos","events_url":"https://api.github.com/users/JohnnyCrazy/events{/privacy}","received_events_url":"https://api.github.com/users/JohnnyCrazy/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/labels/discussion","name":"discussion","color":"bfe5bf"},{"url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/labels/help%20wanted","name":"help wanted","color":"207de5"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/milestones/2","html_url":"https://github.com/JohnnyCrazy/SpotifyAPI-NET/milestones/3.0","labels_url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/milestones/2/labels","id":1984576,"number":2,"title":"3.0","description":"","creator":{"login":"JohnnyCrazy","id":3109892,"avatar_url":"https://avatars.githubusercontent.com/u/3109892?v=3","gravatar_id":"","url":"https://api.github.com/users/JohnnyCrazy","html_url":"https://github.com/JohnnyCrazy","followers_url":"https://api.github.com/users/JohnnyCrazy/followers","following_url":"https://api.github.com/users/JohnnyCrazy/following{/other_user}","gists_url":"https://api.github.com/users/JohnnyCrazy/gists{/gist_id}","starred_url":"https://api.github.com/users/JohnnyCrazy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JohnnyCrazy/subscriptions","organizations_url":"https://api.github.com/users/JohnnyCrazy/orgs","repos_url":"https://api.github.com/users/JohnnyCrazy/repos","events_url":"https://api.github.com/users/JohnnyCrazy/events{/privacy}","received_events_url":"https://api.github.com/users/JohnnyCrazy/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":0,"state":"open","created_at":"2016-09-05T16:39:13Z","updated_at":"2016-09-05T16:43:07Z","due_on":null,"closed_at":null},"comments":3,"created_at":"2016-09-05T16:43:06Z","updated_at":"2016-09-07T00:28:40Z","closed_at":null,"body":"This issue covers the following change: Rewrite and Redesign of our Auth-Services and HTTP-Requests for the Spotify Web-API\r\n\r\n## Auth Services Web-API\r\n\r\nBefore I go into detail, I will quickly explain how each Auth-Service is working, you can find detailed infos at their Web-API docs.\r\n\r\n* Credentials-Auth\r\n* ImplicitGrant-Auth\r\n* AuthorizationCode-Auth\r\n\r\n### Credentials-Auth\r\nThis one is fairly easy, it uses both, `clientId` and `clientSecret` and you just need to make a call to spotify with both values and you will receive your token. You can't access account data with it, so there is no user-action involved. This one would be suited for pure server-side applications while no access to user-data is needed. In the following I will ignore this Auth-Service, since it can be achieved with pure HTTP-Requests, no server required.\r\n\r\n### ImplicitGrant-Auth\r\nThis Auth-Service is short lived and requires user-action but will also give you access to account-data. It was designed for use on sites like [jsfiddle](http://jsfiddle.com), where you have no direct HTTP-Server and only have access to some Client JS code. The token will be passed as a hash-fragment in your return url. So, technically, the HTTP-Server can't fetch this token since hash-fragments are a browser concept and are not send over the wire. You could write some client-js, fetch the token, and redirect with the token as query-parameter. But this is hacky. Also, this would require adding `localhost:XXXX` to your allowed redirect URLs inside spotify (like we currently have to do it) --> Anyone can create tokens based on your `clientId`. This currently is the case.\r\n\r\n### AuthorizationCode-Auth\r\nThis is the perfect Auth-Service for servers. This also uses `clientId` and `clientSecret`, so this is also just a server-side Auth-Service. It requires user-action, gives access to account-data and provides a refresh token. This refresh token can be used to get a new `token` without having the user to login again. After the user granted access, he will be redirected to an URL where the token is passed via parameter --> perfect for an HTTP-Server.\r\n\r\n## Ideas for the redesign/rewrite\r\n\r\n* **Patch** Credentials-Auth: Make it cross-platform using `HttpClient`\r\n* **Delete** ImplicitGrant-Auth: It's not secure enough\r\n* **Major** AuthorizationCode-Auth: This should be our main focus, more below\r\n* **Patch** SpotifyWebAPI: Cross-Platform, replace `WebClient` with `HttpClient`\r\n\r\n### Cross-Platform\r\n\r\nWe should make the whole Web-API cross-platform so we can run this shit on linux servers and actually use those auth methods correctly :P.\r\n\r\nThis would require following changes:\r\n* Replace `WebClient` with `HttpClient` (`HttpClient` doesn't provide sync methods, we need some workaround)\r\n* Rewrite the HTTP-Server (more below)\r\n\r\n### HTTP-Server\r\nThe HTTP-Server currently is mostly messy due to the fact I took it from stackoverflow or something similar and just edited it. It will only be used for AuthorizationCode-Auth. We need to provide enough configuration like ports, bind to specific IP-Adresses, and my favorite feature: custom HTML. Currently, a rather simple message shows that authentication was successful. It would be nice to support injecting custom HTML into the response, or, even better, a custom redirect once everything is authed. The whole API is still to design, we can either go for async-methods or events like we did before.\r\n\r\nRegarding AuthorizationCode-Auth:\r\nWe need to abstract the actual auth process in two types:\r\n* **Standalone HTTP-Server:**  \r\n  This will use the HTTP-Server above. It's useful when you don't need any further HTTP stuff. You just need it once and only for authenticating.\r\n* **Custom Handler:**  \r\n  Let's say we already have an ASP.NET app running. It would be stupid to start another HTTP-Server. Better: Due to the abstraction, we can implement our own strategy. We could define our own route within ASP.NET, fetch the token, and call our strategy callback.\r\n\r\nI though of something like the following:\r\n* An interface `AuthorizationCodeStrategy`\r\n* A class `AuthorizationCodeAuth` which has one `AuthorizationCodeStrategy`\r\n* A class `AuthorizationCodeServer` which implements `AuthorizationCodeStrategy` and handles a HTTP-Server internally\r\n\r\nThis way, everyone can make their own strategy without us having to add a dependecy to some large framework. We could even provide strategies in some other repo with specific dependecies.\r\n\r\nA lot of text, I hope you have some input :+1:  \r\nThis is just the first step, if we have worked out the design-idea, we will go into details and API-design, so don't get started yet :hourglass: \r\n@erinxocon @petrroll @JimmyAppelt"},"comment":{"url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/issues/comments/245138262","html_url":"https://github.com/JohnnyCrazy/SpotifyAPI-NET/issues/104#issuecomment-245138262","issue_url":"https://api.github.com/repos/JohnnyCrazy/SpotifyAPI-NET/issues/104","id":245138262,"user":{"login":"erinxocon","id":208567,"avatar_url":"https://avatars.githubusercontent.com/u/208567?v=3","gravatar_id":"","url":"https://api.github.com/users/erinxocon","html_url":"https://github.com/erinxocon","followers_url":"https://api.github.com/users/erinxocon/followers","following_url":"https://api.github.com/users/erinxocon/following{/other_user}","gists_url":"https://api.github.com/users/erinxocon/gists{/gist_id}","starred_url":"https://api.github.com/users/erinxocon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erinxocon/subscriptions","organizations_url":"https://api.github.com/users/erinxocon/orgs","repos_url":"https://api.github.com/users/erinxocon/repos","events_url":"https://api.github.com/users/erinxocon/events{/privacy}","received_events_url":"https://api.github.com/users/erinxocon/received_events","type":"User","site_admin":false},"created_at":"2016-09-07T00:28:40Z","updated_at":"2016-09-07T00:28:40Z","body":"https://github.com/spotify/web-api-auth-examples"}}
{"actor":{"display_login":"erinxocon"}}