stan/website
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

spotify: manual 302 for external redirects in /api/spotify/connect (kit refuses redirect() to external origins)
Some checks failed
Deploy production / deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Stan Runge
2026-10-24 16:12:10 +00:00
parent 4738f10ad1
commit 3903317a59
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/routes/api/spotify/connect/+server.ts
View File

@@ -1,5 +1,5 @@
import { SPOTIFY_CLIENT_ID } from '$app/env/private'; import { SPOTIFY_CLIENT_ID } from '$app/env/private';
import { error, redirect } from '@sveltejs/kit'; import { error } from '@sveltejs/kit';
import { requireOwner } from '#lib/server/owner.js'; import { requireOwner } from '#lib/server/owner.js';
import { import {
authorizeUrl, authorizeUrl,
@@ -9,13 +9,18 @@ import {
} from '#lib/server/music/oauth.js'; } from '#lib/server/music/oauth.js';
import type { RequestHandler } from './$types'; import type { RequestHandler } from './$types';
// SvelteKit refuses redirect() to external origins; build the 302 by hand.
// Cookies set via event.cookies are still attached to this Response.
const externalRedirect = (location: string) =>
new Response(null, { status: 302, headers: { location, 'cache-control': 'no-store' } });
// Owner only: start the Spotify Authorization Code flow for the listening tracker. // Owner only: start the Spotify Authorization Code flow for the listening tracker.
export const GET: RequestHandler = (event) => { export const GET: RequestHandler = (event) => {
requireOwner(event); requireOwner(event);
const { url, cookies } = event; const { url, cookies } = event;
// The state cookie must be set on the host Spotify redirects back to. // The state cookie must be set on the host Spotify redirects back to.
if (url.hostname === 'www.stanrunge.dev') if (url.hostname === 'www.stanrunge.dev')
redirect(302, 'https://stanrunge.dev/api/spotify/connect'); return externalRedirect('https://stanrunge.dev/api/spotify/connect');
if (!SPOTIFY_CLIENT_ID) error(503, 'Spotify is not configured on this server.'); if (!SPOTIFY_CLIENT_ID) error(503, 'Spotify is not configured on this server.');
const state = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url'); const state = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64url');
cookies.set(STATE_COOKIE, state, { cookies.set(STATE_COOKIE, state, {
@@ -25,5 +30,5 @@ export const GET: RequestHandler = (event) => {
sameSite: 'lax', sameSite: 'lax',
maxAge: 600 maxAge: 600
}); });
redirect(302, authorizeUrl(SPOTIFY_CLIENT_ID, `${publicOrigin(url)}${CALLBACK_PATH}`, state)); return externalRedirect(authorizeUrl(SPOTIFY_CLIENT_ID, `${publicOrigin(url)}${CALLBACK_PATH}`, state));
}; };