Skip to content

Raw deeplinks #225

@grctest

Description

@grctest

Is your feature request related to a problem? Please describe.

Currently the TOTP deeplinks which use the beet:// protocol require the user handle a pass code which is used to encrypt the deeplink, providing protection against click-jacking.

If however you wish to parse the contents of the URL prior to clicking it, its' payload is encrypted so you cannot easily do so.

Describe the solution you'd like

Create a 'Raw beetlink' page, identical to TOTP minus the need for a timed passcode and without payload encryption. This would enable the manual construction of deeplinks without the use of a 3rd party app as well as enable interrogation of deeplink payload prior to clicking it.

The click-jacking risk would still be offset somewhat by the necessity of having the raw beetlink page open, otherwise the request is rejected, similar to the TOTP page, so it's not irresponsible to implement this feature.

We could either include an unencrypted field in the deeplink like ?raw=true to indicate it's unencrypted raw beetlink instead of a TOTP clicked link, or we could use a new protocol like rawbeet://

Describe alternatives you've considered

Use QR codes if timed codes are annoying
Check console logs in 3rd party app for request contents prior to clicking deeplinks

Additional context

Implementation would be a copy/paste of TOTP with fewer lines of code.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions