Repository navigation
Use PKCE for the Trakt OAuth sign-in - #1803
Open
julienbeugras wants to merge 1 commit into
Open
julienbeugras wants to merge 1 commit into
julienbeugras wants to merge 1 commit into
Conversation
Trakt now rejects the authorization request with "code_challenge is required for this client" (FuzzyGrim#1744), which breaks private-profile imports. Apps created on Trakt today are not issued a client secret at all. Each sign-in generates a code verifier, stores it with the OAuth state in the session, and sends its S256 challenge to the authorize endpoint, now https://auth.trakt.tv/oauth/authorize as in Trakt's PKCE guide (the old URL redirects there). The token exchange sends the verifier back. A sign-in started before this change has no stored verifier and exchanges its code as before. The client secret is sent to the token endpoint only when one is configured, for both the code exchange and the refresh used by imports, since Trakt asks PKCE apps not to send one. Closes FuzzyGrim#1744 Closes FuzzyGrim#1772
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1744
Closes #1772
Trakt now requires PKCE: the private import's sign-in fails with
invalid_request: code_challenge is required for this client. Apps created on Trakt today are also not issued a client secret (Trakt's PKCE guide).Changes
trakt_oauthgenerates a code verifier for each sign-in (trakt.generate_pkce_pair), stores it with the existing OAuth state in the session, and sends the S256code_challengetohttps://auth.trakt.tv/oauth/authorize, the URL given in Trakt's guide (the oldtrakt.tv/oauth/authorizeredirects there).handle_oauth_callback, which sends it ascode_verifier. A sign-in started before this change has no stored verifier and exchanges its code as before.client_secretis sent to the token endpoint only whenTRAKT_API_SECRETis set, for both the code exchange and the refresh-token request the importer makes. Trakt asks PKCE apps not to send one, and new apps have none.Tests
client_secretis omitted when not configured (code exchange and refresh) and sent when configured.The new tests fail against
dev.manage.py test app users integrations lists events --parallelpasses apart fromtest_hardcover_book, which fails ondevtoo (live provider data).ruff check src,ruff format --check srcand the pre-commit hooks pass.Tested against Trakt with a newly created app (no client secret): on
devthe authorize request returns thecode_challenge is requirederror; with this branch the sign-in completes, the code exchange succeeds, and the private import runs, refreshing its token without a secret. Not tested live: an older app that has a client secret, which still sends it.