PKCE Auth Flow does not honor the show_dialog=false option?

[ktuli44]

I am in the process of switching my app over to use PKCE Auth Flow and ever since I did, each time I try to get an authorization code to use to obtain a token, I am being sent to the Spotify authorization page, whereas with the Basic Auth Flow, I was sent to the authorization page once and then basically never had to see it again.

Am I doing something wrong?

[ktuli44]

Is anyone else seeing this behavior with the PKCE Auth Flow?

[tobikabla]

Is this still an issue for you? Cause I would really like to switch to PKCE Auth Flow 🙂

[ktuli44]

Yes - I have not been able to figure this one out, but I do still use PKCE as the standard auth flow will only renew the token once and then it doesn't give you any more refresh tokens.  So that is the trade-off... if you want to renew the token more than once, it seems you have to allow the login to happen each time.

[Peter_Schorn]

Did you read the documentation? the show dialog parameter doesn't exist for this authorization flow.

[tobikabla]

Thanks for clarifying this.

@ktuli44 what is your use case? Do you have to re-authorize your users often?
Usually once you have the refresh_token you can just renew your acces_token once it expires.

[ktuli44]

I know the documentation doesn't specifically mention the show_dialog for the PKCE auth flow, but as it is previously mentioned, it was not clear if that meant it is intentionally not available for PKCE or not.

I do use the refresh tokens to get new tokens, but each time a user returns to the website it requires authentication again.  I suppose I could put a different authentication wall in place or I could simply use cookies, but that seemed like a risk to let the user's token get hijacked.

So far I've just left it in place that it requires auth each time the user logs in.  Only a minor annoyance for higher security.

[tobikabla]

It's interesting to think about how to securely store the token client side in the browser. Probably it will never be safe? The only part you can be sure about is the redirect on authorize because it comes back to your app but all token calls could be faked from somewhere else.

I wonder how the official spotify web player handles this?

Personally I use localStorage, which of course is not very safe. Until now I use the Authorization Code Flow so in the worst case I can change the client secret that is only on the server-side and invalidate all existing tokens. But then you would have to be aware on any leaks if they exist.

[Peter_Schorn]

You can renew the access token as many times as you want with the "standard auth flow". You just use the same refresh token each time. And if you don't want your users to have to login again each time they return to your site, then you should figure out a way of persistently storing the authorization information.