mirror of
https://github.com/librespot-org/librespot.git
synced 2026-04-27 00:05:55 +03:00
[GH-ISSUE #1501] oauth2 token -> stored credentials #677
Labels
No labels
A-Alsa
SpotifyAPI
Tokio 1.0
audio
bug
can't reproduce
compilation
dependencies
duplicate
enhancement
good first issue
help wanted
high priority
imported
imported
invalid
new api
pull-request
question
reverse engineering
wiki
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/librespot#677
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @salvatorebattiato on GitHub (May 26, 2025).
Original GitHub issue: https://github.com/librespot-org/librespot/issues/1501
As you probably have noticed, spotify introduced the ability to login from desktop clients via the qr code you usually get in car/tv apps. The fun thing is that it's able to login5 after the oauth flow somehow, being able to store a fully qualified session with saved credentials. That would be awesome to have for alternative clients as it's a 1-click way to login through the mobile app.
Unfortunately, there's no http[2] api endpoint that manages this exchange, and everything is done under the hood by (probably) the TrIPE protocol running on access points at :4070
This is what i've found by digging app traffic with wireshark
I'll post all the files needed in case someone wants to have fun reverse-engineering the TrIPE messages with the access point, below there's a dump of the encrypted conversation, the ssl keylog to decrypt the pcap with all http requests for reference (packets in it are almost all spotify-related, since I routed all traffic through a sock5 proxy and tcp-dumped it, as this was the only way to "see" the raw tcp traffic to the ap server)
There's also the output username and stored password that should show up in the decrypted conversation and the automotive apk bundle in case there are some symmetric keys waiting to be dumped
spotify-automotive-apk-bundle.zip
spotify-traffic.zip
@kingosticks commented on GitHub (May 26, 2025):
I didn't know they now offered that, that's cool. I've never heard of tripe, nor can I find anything when I search for that. I thought this was just known as "device flow", like described at https://community.spotify.com/t5/Spotify-for-Developers/Device-Authorization-Grant-authentication-flow-for-custom/td-p/5485468
Actually, I wonder if just doing what's described there but using Spotify's client ID would just work for us.. I don't think I've ever actually tried!
@salvatorebattiato commented on GitHub (May 26, 2025):
Yeah, that gives you a bearer token qualified for streaming and other stuff, but not as powerful as one got from login5. For example, with the login5 bearer you can do session transfers and get an sp_dc and xcsrf token. The oauth2 login flow is weaker, you can just put a valid client id scraped from any whitelisted client (car, tv, desktop) and it just works in getting you a weak bearer and the relative refresh token (used to get another bearer after it expired)
I don’t know if you actually need this implemented as a login5 plugin in librespot, but reverse engineering the protocol running on 4070 would be fun. I don’t have the software skills to go that deep in pentesting. I almost reverse engineered all Spotify login related private apis, and I’d love to know what’s going on with access points.
@kingosticks commented on GitHub (May 26, 2025):
Have you seen how our oauth flow works today? We can create a "weak" Access Point session using the resulting oauth access token, and then use that to obtain a "full" reusable credentials session. This is (was?) what their desktop app was doing. I envisioned the same thing but initially using the oauth device flow instead. Would be nice to see if it's possible.
I don't remember if that full session provides the other tokens you mention, but once you're in you have everything required to then create a login5 session also.