Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The only way to revoke Spotify API tokens is to delete your account

olav.it

Post reply on HN
Print view View original

31–40 of 41 posts

Re: The only way to revoke Spotify API tokens is to delete your account

#31

Post by acchow »

EdJiang wrote: post #20
yoo1I wrote: post #12

Earlier quoted context omitted.

Would you mind sharing a bit what makes you say it's really hard ?

No problem. It might not seem obvious when you build small-mid size backends, because in that scenario you might have an access token stored in your database that's checked each time someone makes a request. Token revocation is as easy as deleting that access token from your database. Once you start building something at scale, it's harder to revoke tokens instantly. You still need to validate the token on each reque…

> So for token revocation, you now need to create a cache invalidation scheme

To be a cache, it needs an invalidation scheme already.

Also, no one is asking for "instant" consistency on revoking a token, but at least "eventual consistency".

Re: The only way to revoke Spotify API tokens is to delete your account

#32

Post by chris_7 »

cissou wrote: post #11

This could actually be the source of a bug I (and others) have been experiencing for a while. I'm listening to Spotify when all of a sudden, music pauses and I get a "your account is being used somewhere else". The first few times I actually though it was true, but since then I've tried to "log out from every device" and log in again on one device, only to find the bug happening again 2 minutes later. Seeing that, my…

Do you have two or more MacBooks? Kill app nap for Spotify on all of them:

    defaults write com.spotify NSAppSleepDisabled -bool YES

Re: The only way to revoke Spotify API tokens is to delete your account

#33

Post by seanp2k2 »

acchow wrote: post #31
EdJiang wrote: post #20

Earlier quoted context omitted.

No problem. It might not seem obvious when you build small-mid size backends, because in that scenario you might have an access token stored in your database that's checked each time someone makes a request. Token revocation is as easy as deleting that access token from your database. Once you start building something at scale, it's harder to revoke tokens instantly. You still need to validate the token on each reque…

> So for token revocation, you now need to create a cache invalidation scheme To be a cache, it needs an invalidation scheme already. Also, no one is asking for "instant" consistency on revoking a token, but at least "eventual consistency".

Yeah, this. I don't care if it takes 24 hours to revoke it across the board, just let me revoke it somehow. Sub-second revocation isn't something that I'm aware of anyone asking for in this instance, and global Cassandra quorum should be on the order of a few seconds for massive data stores. Even with aggressive caching and long TTLs, you could do something with event notification for the rare events in which someone invalidates a token, and get it propagated within seconds around the world.

Re: The only way to revoke Spotify API tokens is to delete your account

#34

Post by runeks »

I really hope we move past a model where a company both needs good lawyers, to get the licensing deal with the record companies, and a good software team, to get the app right. I really hope an intermediate layer arises, such that talented app developers can write good streaming music apps without needing to talk to the RIAA first, but rather by just purchasing access to the content through some "music wholesale" service.

Re: The only way to revoke Spotify API tokens is to delete your account

#36

Post by ars »

EdJiang wrote: post #20
yoo1I wrote: post #12

Earlier quoted context omitted.

Would you mind sharing a bit what makes you say it's really hard ?

No problem. It might not seem obvious when you build small-mid size backends, because in that scenario you might have an access token stored in your database that's checked each time someone makes a request. Token revocation is as easy as deleting that access token from your database. Once you start building something at scale, it's harder to revoke tokens instantly. You still need to validate the token on each reque…

They manage to distribute your password everywhere don't they?

IMO every auth key should always be hashed with your password (or its hash) - changing your password should automatically revoke every auth key even if you don't do it manually.

Re: The only way to revoke Spotify API tokens is to delete your account

#37

Post by y46ukgrc2n6 »

dangerlibrary wrote: post #3

Spotify, in general, appears to consider accounts disposable. I think I saw something about this getting better recently, but a few months ago the only way to move my paid account to a family subscription was to delete the old account and create new accounts for everyone I wanted in the family plan.

I attempted to do exactly the same operation on Google Music and it was even worse. It wouldn't show the option to upgrade to a family plan anywhere. Turns out that signing up for Google Music All Access also gets you YouTube Red, and that YouTube Red subscription has to be deleted before you can upgrade All Access to the family plan (which also gives you a new YouTube Red subscription). It took a conversation with a google support rep to figure this out, and I think someone who is not a programmer would have a harder time understanding this failure mode.

Re: The only way to revoke Spotify API tokens is to delete your account

#38

Post by stable-point »

ars wrote: post #36
EdJiang wrote: post #20

Earlier quoted context omitted.

No problem. It might not seem obvious when you build small-mid size backends, because in that scenario you might have an access token stored in your database that's checked each time someone makes a request. Token revocation is as easy as deleting that access token from your database. Once you start building something at scale, it's harder to revoke tokens instantly. You still need to validate the token on each reque…

They manage to distribute your password everywhere don't they? IMO every auth key should always be hashed with your password (or its hash) - changing your password should automatically revoke every auth key even if you don't do it manually.

When generating auth tokens for Django apps, I've previously put the user's password's salt into the token for this purpose. The salt is not secret and changes whenever the password changes.

Re: The only way to revoke Spotify API tokens is to delete your account

#39

Post by cocotino »

dangerlibrary wrote: post #3

Spotify, in general, appears to consider accounts disposable. I think I saw something about this getting better recently, but a few months ago the only way to move my paid account to a family subscription was to delete the old account and create new accounts for everyone I wanted in the family plan.

I remember back when they had a limit of minutes per month and I had to create like 5 Facebook accounts to bypass it.

Re: The only way to revoke Spotify API tokens is to delete your account

#40

Post by lyonlim »

dangerlibrary wrote: post #3

Spotify, in general, appears to consider accounts disposable. I think I saw something about this getting better recently, but a few months ago the only way to move my paid account to a family subscription was to delete the old account and create new accounts for everyone I wanted in the family plan.

Indeed. Some time back (more than one year ago), I contacted support to delink my paid account from Facebook. Their suggestion was to create a new account... and I think they helped with transferring my playlists, then deleted my Facebook-linked account.
Post reply on HN