iOS: native API client, credentials in the keychain #419
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
The app's only credential is the web view's Cloudflare Access cookie; when it expires mid-drive playback stops with 'Sign in again' (ios/README.md, Not yet). Send an ipx API token (Authorization: Bearer) plus a Cloudflare Access service token (CF-Access-Client-Id / CF-Access-Client-Secret), all kept in the keychain, from the player's requests. Needed by CarPlay, which has no web view.
Fixed in
f6042e9and7d4456b: Credentials.swift keeps an ipx API token and a Cloudflare Access service token in the keychain, and the player sends them on its audio, position, read-flag and artwork requests; shake, Player Tokens enters them. The ipodderx Access application got a Service Auth policy for the ipx-ios service token. Checked on a phone: it plays. In TestFlight build 2 (iOS 0.1.0).Reopened: closed on 'it plays', which a cookie-only player also does. Reworked in
3626a30: one API token sent to https://ipxapi.sdf1.net (tunnel route, no Access, Cloudflare firewall rule limiting it to the app's paths; see docs/sso.md). Server side checked: no bearer 403, off-list paths 403, bad bearer 401 from ipx. Not yet checked on a phone with the token set and the page signed out. Build 4.Checked on the phone with TestFlight build 14: works.