Refresh token JS

[BarryCarlyon]

@Lilrex

I know security is incredibly important but so many devs fail to realize that students are students, they are just trying to fulfill the requirements of the course. We don’t have control over what our assignments want we just do it to get our grade.

By literally doing the worst thing that you can do that is also prohibited under the Twitch API Developer Agreement, that you agreed to by creating a ClientID?

YOU MUST NOT LEAK YOUR CLIENT SECRET

https://www.twitch.tv/p/en-gb/legal/developer-agreement/

IV. Developer Accounts and Rate Limits

B. Keys. Once you have successfully registered Your Services, you will be issued one or more unique security keys, secrets, tokens, access codes, passwords or other credentials (collectively, “Keys”). The Keys enable us to associate your Program Materials with Your Services and end users of Twitch Services. All activities that occur using your Keys are your responsibility. Keep them secret. Also, you may not sell, transfer, or sublicense them.

You are literally violating your agreement with Twitch. And putting your users of your application at risk

In addition every, single, API that uses secrets will say the same thing here. You cannot and shouldn’t be leaking your Client Secret via this sort of call.

If you must do this sort of call client side. Then you should be using implicit auth and not regular oAuth. Implicit auth’s cannot be renewed/refreshed by design. (Other than sending the user round the oAuth dance again)

Getting OAuth Access Tokens