33 results found
-
Please document optional OAuth 2.0 authorization flow parameter "nonce" Imagine the following attack for the OAuth 2.0 authorization flow:
- Attacker steals the authorization code from the redirect URI.
- Attacker forces his instance of the client to redeem the victim's authorization code.
- If the attacker's instance of the client is faster than the victim's instance of the client in redeeming the authorization code, the attacker will get a valid login session within his instance of the client, but for the victim's account.
This attack should especially get attention in the context of Twitch and live streaming, since many streamers are definitely not aware of this vulnerability: If people are logging…
20 votesThere is no available none parameter for OAuth 2.0 authorization flow. This appears to only be available in OIDC, which has it documented.
-
Add documentation about how the Chat Filters feature is implemented. Could you please add documentation about how the chat filters feature in web chat is implemented? Other chat client could really benefit from filtering those messages or highlighting them for moderators as suspicious behavior.
To pin point the exact feature I provided screenshots from the official web browser chat:
- in action: https://i.imgur.com/CfzMx0z.png
- and the associated settings: https://i.imgur.com/8dYADBk.png10 votesAs this feature utilizes automatic moderation features from Twitch, and those features are ever-changing with improvements, we do not wish to document the inner workings of these features.
-
Document how join and authentication limits apply to anonymous connections. https://dev.twitch.tv/docs/irc/guide#command--message-limits says:
- 20 authenticate attempts per 10 seconds per user (200 for verified bots)
- 20 join attempts per 10 seconds per user (2000 for verified bots)however it's unclear how these limits apply to anonymous connections. Is there no limit to join attempts at all when you have authenticated as an anonymous user? And do authentication attempts for anonymous users (NICK justinfan12345) count towards the rate limit?
4 votesWe do not wish to document the usage of anonymous IRC connections at this time.
-
The documentation doesn't express how to properly authenticate a chatbot without human intervention This page suggests "OAuth Authorization code flow" but i don't believe this is correct because for a chatbot to be effective you would need the access token to never expire or the process to handle expiry and refresh to be event driven. Having a robot/non-existing user login seems misleading or wrong.
3 votesThis is correct, but the example we are providing is to help understand the core concepts of Twitch. Our provided guides should not be used directly in production.
-
How to send a basic API GET request with ajax or postman Unhelpful page. I want to send an API request to test through Postman, but I do not understand what format to put it in. It is asking for an OAuth token, but that request does not mention anything about that. Very confusing.
3 votes -
Expand on V5 to Helix mappings the V5 scope 'user_read' is not listed here. In the migration document it suggests that that is equivalent to the helix scope user:read:email. Is that correct?
Is there a V5 scope that matches the new helix user:read:broadcast
3 votesSome of this work was performed, but since it is now well past the deprecation of V5 we do not wish to continue providing new migration documentation for V5 to Helix.
-
How to link out on a mobile extension Twitch documentation does not state how to handle opening a new window on a mobile extension.
3 votes -
Specifying unit of "expires_in" Hello,
I'd like for the page to document that the "expires_in" property the server sends when you get a token back is using "seconds" as a unit.
It is pretty obvious when you consider "14124" would be 14 seconds if it was milliseconds, but it would also be almost 10 days if it was in minutes
2 votes -
Clarify endpoint documentation What units are the expiry time in? Does the endpoint return any other error messages?
2 votesAs per OAuth2 specification, expires_in represents seconds. We do not plan to add additional clarification tin the documentation at this time.
-
Fix the example GitHub repo to better correlate to the documentation on this page Provide a link to the referenced branch associated with each step.
There are no branches for steps 3 and 4. The existing branches don't correlate to the code presented for each step on this page.
And there's messy commented out code in all of the files on GitHub.Also, 4 steps are explained, and then the last sentence in this doc mentions the Step 1 branch
2 votesWe plan on completely rewriting this tutorial for clarity, but as far as the current tutorial goes we do not plan on making small changes to it at this time.
-
lol !/usr/bin/env/python
import BaseHTTPServer, SimpleHTTPServer
import sslcertfile = "./localhost.pem"
keyfile = "./localhost-key.pem"class RequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
def endheaders(self):
self.sendheader("Cache-Control", "no-cache, no-store, must-revalidate")
self.sendheader("Pragma", "no-cache")
self.sendheader("Expires", "0")
SimpleHTTPServer.SimpleHTTPRequestHandler.end_headers(self)httpd = BaseHTTPServer.HTTPServer(
('', 8080),
RequestHandler
)httpd.socket = ssl.wrapsocket(
httpd.socket,
serverside=True,
keyfile=keyfile,
certfile=certfile
)httpd.serve_forever()
2 votes -
"Registering your App" an Extension is also an App https://dev.twitch.tv/docs/authentication
Says
Authentication involves: Registering your app to obtain a client ID and client secret. Getting a token. This includes specifying scopes, the permissions your app requires. Sending the token in your API request, to authenticate API requests.But doesn't mention that an Extension is also an Application
This docs fix would be needed on other pages where "registering an app" is mentioned
2 votesAn Extension is technically an application, but we do not want to encourage the creation of Extensions as if they were regular Applications.
-
я ни чего не имею dead spast3
2 votes -
More information about 'id' uniqueness More information is required about the uniqueness of id. Is it unique forever (i.e. there will never be two messages with the same id) or is it just guaranteed unique within a timeframe?
2 votesSince message IDs are UUIDs, they can be assumed to be universally unique as there's a 1 in 3.4 × 10³⁸ chance of collision. Due to the very small chance of this collision happening, we're choosing not to make mention of it in the documentation.
-
Add .env files in the Managing Extension Secrets section Another way to manage an extension secret is to use a .env file. The .env file can be used to store all kinds of secrets, tokens, and passwords.
eg: TOKEN=testT0K3N
note: .env is a shell file so there can't be spaces around =
2 votesWhile this is a useful for for managing secrets during development, we do not wish to recommend it as it conflicts with our recommendation to rotate your secrets regularly.
-
Date/Version on docs In the dev docs, can you add an "Updated" field with the date of when the page was last updated, or what versions the doc works with? Trying as a newbie now, there's some stale info in here.
2 votesDue to the website stack we are using for the documentation, this is currently not feasible.
However, we are making efforts to update the documentation, and continue to keep it up-to-date in the future.
-
Add links to rate limits Add a link or multiple links to the rate limit information from within the API reference.
2 votes -
Tags - Inconsistency between exemple, list and prototype Some part are missing some informations or contain error :
- Private message : send a tags "returning-chatter" that is not explain and not in the prototype of the command.
- Usernotice : you provide an exemple with the tag "msg-param-recipient-name", this tag is not in the list of tags1 voteWe do not plan on documenting these tags at this time
-
Where is the name listed? "Set Name to your application's name. The name must be unique among all Twitch apps. Your app's name is listed on the Connections page under Other Connections if your app requires user consent to access or modify the user's resources." I do not understand where the name is listed, when I am on the page on which the link sends me there is not that.
1 vote -
"Make your first call" Example not working in the documentation In the get started page (https://dev.twitch.tv/docs/api/get-started) using the code provided in the "Make your first call" paragraph is not working (and also the first request to get the access token), the returned error is:
"URL using bad/illegal format or missing URL"
The error is caused by the use of the single quotation mark (') instead of the double (").
I don't know if this is a Windows limitation or something wrong with my curl version (latest from the curl project https://curl.se/windows/) but I think that this should be corrected or at least mentioned, because I wasted half…
1 voteThis is consistent with the rest of the documentation examples. This problem also only appears to happen on cmd.exe ran on Windows
- Don't see your idea?