177 results found

1. Please document optional OAuth 2.0 authorization flow parameter "nonce"

   Imagine the following attack for the OAuth 2.0 authorization flow:

   1. Attacker steals the authorization code from the redirect URI.
   2. Attacker forces his instance of the client to redeem the victim's authorization code.
   3. If the attacker's instance of the client is faster than the victim's instance of the client in redeeming the authorization code, the attacker will get a valid login session within his instance of the client, but for the victim's account.

   This attack should especially get attention in the context of Twitch and live streaming, since many streamers are definitely not aware of this vulnerability: If people are logging in with Twitch on 3rd party sites while live streaming, an attacker that has automated this attacking process (e.g. by capturing the stream) can easily grab the authorization code from the visible browser address bar during the streamer's login attempt, except ...

   ... the OAuth 2.0 PKCE extension is used by the client, which prevents the attack in the following way:

   1. A hashed secret (using a cryptographic hash function) is send using the nonce parameter of the initial authorization request (leading to the Twitch login page).
   2. Later, the authorization server (that is used to redeem authorization codes) is sending back the same nonce together with the access token.

   The back end implementation (that also securely stores the client secret and makes the call to this authorization server) can now verify whether the nonce sent back from the authorization server is indeed the hashed value of the specific secret.
   An attacker that does not know the secret should now longer be able to force the back end to authorize him with the victim's permissions.
   Of course, the secret is bound to the authentication session and only visible to an attacker in its hashed form (the nonce) within the initial authentication request.

   A few months ago someone suggested to support the OAuth 2.0 authroization flow PKCE extension. [1]
   I don't know if the nonce usage above is exactly the same as PKCE, but it at least prevents attack scenarios like the one that I just described.

   Currently, the documentation does not mention this nonce parameter being available for the OAuth 2.0 authorization flow. [2] It should be added with a short description, similar to the other optional parameters like state or force_verify to make people aware of it.

   This user voice is a clone of this thread in the forum. [3]

   [1] https://discuss.dev.twitch.tv/t/pkce-extension-for-oauth-authorization-code-flow/19575
   [2] https://dev.twitch.tv/docs/authentication/getting-tokens-oauth#oauth-authorization-code-flow
   [3] https://discuss.dev.twitch.tv/t/please-document-optional-oauth-2-0-authorization-flow-parameter-nonce/23357

   Imagine the following attack for the OAuth 2.0 authorization flow:

   1. Attacker steals the authorization code from the redirect URI.
   2. Attacker forces his instance of the client to redeem the victim's authorization code.
   3. If the attacker's instance of the client is faster than the victim's instance of the client in redeeming the authorization code, the attacker will get a valid login session within his instance of the client, but for the victim's account.

   This attack should especially get attention in the context of Twitch and live streaming, since many streamers are definitely not aware of this vulnerability: If people are logging… more

   18 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Investigating  ·  2 comments  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

2. Add existing IRC WHISPER command to IRC documentation

   The IRC gateway passes whispers using the WHISPER code:

   [16:36:15] [@] @badges=bits-charity/1;color=#3E2E18;display-name=foo;emotes=;message-id=2;thread-id=21001676_470220570;turbo=0;user-id=2109996;user-type= :foo!foo!foo.twitch.tv WHISPER myuser :this is a whisper
   

   But I am unable to find any reference to that code on https://dev.twitch.tv/docs/irc/commands where I would expect it, or any other documentation page under the "Chatbots and IRC" section.

   I would suggest adding the WHISPER command to the list of commands at the top of the page on the IRC: Commands section, something similar to:
   
WHISPER Receive a Whisper message from another user


   and then the prototype at the bottom, to include the fact that it appears the WHISPER command is (appears to be) a one-way command (the server can send a WHISPER to you, but you can't send a WHISPER to other users. (When I tried to send a whisper, I got: [16:45:58] tmi.twitch.tv reported an error: WHISPER :Unknown command).

   Or maybe this is deprecated or not final yet, but I figured I'd point it out just in case it was an oversight. Thanks for all the hard work!

   The IRC gateway passes whispers using the WHISPER code:

   [16:36:15] [@] @badges=bits-charity/1;color=#3E2E18;display-name=foo;emotes=;message-id=2;thread-id=21001676_470220570;turbo=0;user-id=2109996;user-type= :foo!foo!foo.twitch.tv WHISPER myuser :this is a whisper
   

   But I am unable to find any reference to that code on https://dev.twitch.tv/docs/irc/commands where I would expect it, or any other documentation page under the "Chatbots and IRC" section.

   I would suggest adding the WHISPER command to the list of commands at the top of the page on the IRC: Commands section, something similar to:
   
WHISPER Receive a Whisper message from another user


   and then the prototype at the bottom, to include the fact that it appears the WHISPER command is… more

   15 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Investigating  ·  1 comment  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

3. Extension Pubsub Docs missing whisper targer.

   https://dev.twitch.tv/docs/extensions/reference/#send-extension-pubsub-message

   The docs say Valid values: "broadcast", "global".

   But, the target 'whisper-opaqueId' to send "per user" pusub message is missing.

   14 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Investigating  ·  1 comment  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

4. Add documentation about how the Chat Filters feature is implemented.

   Could you please add documentation about how the chat filters feature in web chat is implemented? Other chat client could really benefit from filtering those messages or highlighting them for moderators as suspicious behavior.

   To pin point the exact feature I provided screenshots from the official web browser chat:
   - in action: https://i.imgur.com/CfzMx0z.png
   - and the associated settings: https://i.imgur.com/8dYADBk.png

   10 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

5. PubSub Docs don't mention Token Type

   From: https://github.com/twitchdev/issues/issues/25

   Brief description

   https://dev.twitch.tv/docs/pubsub#topics

   PubSub documentation mentions the requirement to use an oAuth token, but doesn't directly specify which type of token, nor the requirement for the UserID of the token to match the UserID of the topic.

   Authentication
   All topics require an OAuth token, but only some topics have a specific required scope (noted in the table below).
   
   Available Topics
   All topics require an OAuth token, but only some topics have a specific required scope (noted in the table).
   

   Expected documentation

   Authentication
   All topics require a User Access OAuth token, where the UserID of the token matches the userID of the topic, but only some topics have a specific required scope (noted in the table below).
   
   Available Topics
   All topics require a User Access OAuth token, where the UserID of the token matches the userID of the topic, but only some topics have a specific required scope (noted in the table).
   

   Additional context or questions

   Raised on the forums at

   https://discuss.dev.twitch.tv/t/only-getting-err-badauth-from-listen-pubsub-request/23598/3

   From: https://github.com/twitchdev/issues/issues/25

   Brief description

   https://dev.twitch.tv/docs/pubsub#topics

   PubSub documentation mentions the requirement to use an oAuth token, but doesn't directly specify which type of token, nor the requirement for the UserID of the token to match the UserID of the topic.

   Authentication
   All topics require an OAuth token, but only some topics have a specific required scope (noted in the table below).
   
   Available Topics
   All topics require an OAuth token, but only some topics have a specific required scope (noted in the table).
   

   Expected documentation

   Authentication
   All topics require a User Access OAuth token, where the UserID of the token matches the

   … more
   10 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Planned  ·  1 comment  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

6. Move GitHub repository to official Twitch organization

   Please host the example code in an official Twitch organization on GitHub such as:
   https://github.com/TwitchDev
   https://github.com/twitchtv

   8 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Investigating  ·  1 comment  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

7. Get Broadcaster Subscriptions Events

   From: https://github.com/twitchdev/issues/issues/8

   Brief description
   The subscription events API is documented as a Webhook topic. but not as a API Endpoint

   https://dev.twitch.tv/docs/api/webhooks-reference#topic-subscription-events

   It used to be in the documentation but is missing

   Expected documentation
   https://dev.twitch.tv/docs/api/reference#get-broadcaster-subscriptions

   But for
   https://dev.twitch.tv/docs/api/reference#get-broadcaster-subscriptions-events

   8 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   0 comments  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

8. Document API and IRC tags for replies

   Web chat users got access to the new "replies" feature, where you can mark your message to be a reply of another message.

   My suggestion is to add official documentation on how third parties can use this feature (for sending messages and for parsing received messages to be a reply)

   7 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Investigating  ·  4 comments  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

9. PubSub Topics: no moderator topic examples/documentation

   https://dev.twitch.tv/docs/pubsub

   Has no examples or documentation for payloads for chatmoderatoractions

   7 votes

   Vote Vote Vote

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

   Vote

   We’ll send you updates on this idea

   Planned  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
   How important is this to you?

   Not at all You must login first! Important You must login first! Critical You must login first!

   We're glad you're here

   Please sign in to leave feedback

   Signed in as (Sign out)

   Close

   Close

10. Fix TMI JS example with Promise handling

    https://dev.twitch.tv/docs/irc#overview

    Row:
    client.connect();

    Should be replaced with:
    client.connect().catch((err) => {console.log('Connection error!', err)});
    or smth like that.

    Let's show users how to write good code, and show them, that all Promises should be handled. Unhandled promise rejections is bad!

    Tmi.js Library also have connect example which contain promise handling

    7 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Planned  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

11. msg-id tags page outdated/incorrect

    From: https://github.com/twitchdev/issues/issues/68

    Docs location: https://dev.twitch.tv/docs/irc/msg-id

    bad_ban_global_mod & bad_timeout_global_mod are gone for as far as i know (ref: https://blog.twitch.tv/en/2018/12/13/thank-you-global-moderators-4d44cfccf22/)

    Missing notices for vip events (vip_success, unvip_success, no_vips, bad_vip_grantee_banned, bad_vip_grantee_already_vip, usage_vip & bad_unvip_grantee_not_vip Might have missed some.

    First line says "These tags apply to both the" and than only names one thing.

    usage_untimeout has "/raid <username>" in the message.

    7 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

12. Data Retention for Banned Events and Moderator Events

    Both

    https://dev.twitch.tv/docs/api/reference#get-banned-events

    https://dev.twitch.tv/docs/api/reference#get-moderator-events

    Only hold only "data" for a finite time period.

    The documentation does not note the time period that data is retained and returned for.

    Hypetrains does not it's 5 days.

    6 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

13. Open Source Twitch Documentation

    Twitch has one of the most intelligent and tech savvy user bases of any product I can think of. If Twitch were to make their documentation source code Open Source, members of the community that are tech savvy enough will do your job for you.

    I just went through the documentation when trying to figure out how to make my first banner and my first Video Player Banner. I am unaware of what a "Video Player Banner" as someone that does not normally watch much Twitch but is attempting to start to learn more about it.

    As someone that works in Open Source and helps with our OS Community management, the first thing I did when I saw it was bad documentation was see if I could contribute to it. If so, I would spend my time learning exactly what it is I'm missing and fix it myself. Your team only needs to take my code contribution. With the user base Twitch has and the creativity of it's creators, Twitch should have the best user experience available in every aspect because they can simply Open Source it to their amazing, very active community.

    I would be happy to help talk about how I (as a legitimate tech professional) would implement this. I think it'd be a HUGE improvement on your processes and follow Conway's Law. Allow your users to design your processes and your users will fall in love with your processes. Twitch, with it's popularity, only needs to curate and run the servers.

    -DevOps Dude

    Twitch has one of the most intelligent and tech savvy user bases of any product I can think of. If Twitch were to make their documentation source code Open Source, members of the community that are tech savvy enough will do your job for you.

    I just went through the documentation when trying to figure out how to make my first banner and my first Video Player Banner. I am unaware of what a "Video Player Banner" as someone that does not normally watch much Twitch but is attempting to start to learn more about it.

    As someone that works… more

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

14. User banned extensions unload

    So it seems that when a user is banned or timed out, extensions unload/are unavailable to those users.

    This is not documented.

    It should be documented somewhere

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Planned  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

15. Please add an example payload of a resubgift/anonresubgift to the PubSub docs

    I raised https://twitch.uservoice.com/forums/310213-developers/suggestions/41016568-context-resubgift-in-resub-events?tracking_code=8f96eb083a992136c313fb0ca1d79054 because I ctrl+f'ed for context as apposed to ctrl+f-ing for resubgift.

    Please add an example for a resub/anonresubgift

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Planned  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

16. Clarify secure website required

    This should say a secure website is required. Took me 2 hours to figure out what was wrong.

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    1 comment  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

17. Emotes referred to as numbers, where this is no longer true

    The PRIVMSG Twitch Tags documententation

    https://dev.twitch.tv/docs/irc/tags#privmsg-twitch-tags

    says

        Information to replace text in the message with emote images. This can be empty. Syntax:
    <emote ID>:<first index>-<last index>,<another first index>-<another last index>/<another emote ID>:<first index>-<last index>...
    emote ID – The number to use in this URL:
    

    Due to channel point modifications, this is no longer true, as emote's are no longer always numbers, they can be xxxx_hf for example

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Investigating  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

18. Webhooks topic(s) don't note required oAuth

    From: https://github.com/twitchdev/issues/issues/59

    Brief description

    Mod Change and Channel ban Change events don't note the required oAuth scope needed for the topic

    https://dev.twitch.tv/docs/api/webhooks-reference#topic-moderator-change-events
    https://dev.twitch.tv/docs/api/webhooks-reference#topic-channel-ban-change-events

    Expected documentation

    Add, (similar to Topic: User Changed)

    Authentication
    User Access Token must have the `moderation:read` for the user in question
    

    Additional context or questions

    https://discuss.dev.twitch.tv/t/webhook-topic-for-channel-ban-change-events-and-moderator-change-events-doesnt-require-oauth-scope/24105

    5 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Planned  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

19. Fix misleading example using CLI to test EventSub handler

    The example for using the CLI to test your handler shows a secret that looks like a 32-byte hexadecimal string. Actually the CLI interprets it as an ASCII string, so the example is actually passing a 64-byte string for the secret. I found this very misleading and it took me a bit of time to figure out why my code was not computing the correct HMAC until I realized that the format the CLI expects is ASCII string not hexadecimal string.

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

20. graph syntax not built on deploy

    The graphs on this page don't look right. The graph syntax is displaying, not the graph itself.

    %% Extensions Overview Diagram
    graph LR
        Twitch --> | - postMessage - | Extension
        Extension --> | - postMessage - | Twitch
        Extension --> | - HTTP - | APIs
        Extension --> | - HTTP - | EBS[Extension Backend]
        Identity --> Twitch
        Chat --> Twitch
        Memes --> Twitch
    

    4 votes

    Vote Vote Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close

    Vote

    We’ll send you updates on this idea

    Planned  ·  0 comments  ·  Documentation  ·  Delete…  ·  Admin →
    How important is this to you?

    Not at all You must login first! Important You must login first! Critical You must login first!

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    Close

    Close