Client credentials tokens expire too soon

[BarryCarlyon]

@ArthurKnoep

The lambda is only communicating to id.twitch.tv , the calls to api.twitch.tv are executed from the extension (I know that it can induce some security issue where the token generated for my extension could be used by other people but I count on CORS to protect my Lambda from being accessed by other services).

But they can extract the Credential from the chrome extension, you may be violating the developer agreement by leaking your Credential publically.

I can install your chrome extension, grab you ClientID and Token from the network tools, and now I am making requests as you

@ArthurKnoep

Well the problem is that I have thousand of users that uses my extension (so there is a lot of token issued). I know that client credentials is not the best OAuth flow for what I’m doing but I don’t want the user to authenticate themselves on the extension (authorization grant, implicit, …), it’s supposed to be a simple extension that read only public information (is a streamer on or off)

You need caching, most streamer data isn’t gonna change more than once per 24 hours, (display_name/login/profile image), sure total followers is gonna change, but cache that for 30 minutes instead perhaps

Fetch one streamer, and return that streamer from your cache, negating the need to hammer the Twitch API as you already have the data.