topic Re: Options for SSL/TLS decryption (corporate network) in Spotify for Developers

Options for SSL/TLS decryption (corporate network)

PositiveIntent — Wed, 02 Oct 2024 04:26:54 GMT

Company performs SSL/TLS decryption for all outbound traffic. This breaks a lot of Spotify components due to certificate pinning(?). I've identified the following hostnames:
apresolve.spotify.com
login5.spotify.com
guc3-spclient.spotify.com
guc3-dealer.spotify.com
spclient.wg.spotify.com
api-partner.spotify.com
audio4-ak-spotify-com.akamaized.net
misc.spotifycdn.com
seed-mix-image.spotifycdn.com
wrapped-images.spotifycdn.com
audio4-gm-fb.spotifycdn.com
heads-fa.scdn.co
misc.scdn.co
audio4-fa.scdn.co
i.scdn.co
newjams-images.scdn.co
dailymix-images.scdn.co
charts-images.scdn.co
lineup-images.scdn.co
mosaic.scdn.co
dealer.spotify.com
Are there any more that need to be excluded from decryption?

Re: Options for SSL/TLS decryption (corporate network)

Ximzend — Sat, 05 Oct 2024 18:55:48 GMT

Domains of video streams that I could find are:

video-akpcw-cdn-spotify-com.akamaized.net

video-ak.cdn.spotify.com.splitter-eip.akadns.net

video-fa.scdn.co

I've found another for the Canvas:

canvaz.scdn.co

Re: Options for SSL/TLS decryption (corporate network)

PositiveIntent — Thu, 10 Oct 2024 15:02:21 GMT

These are helpful thank you! How are you working out which host names the application is using?

Re: Options for SSL/TLS decryption (corporate network)

Ximzend — Thu, 10 Oct 2024 15:06:22 GMT

I found them using a proxy.