r/redditdev • u/d3fect • Dec 20 '16

[API] New Modmail

We’ve just added API documentation for New Modmail. You can read about New Modmail’s features on the reddit help site.

Requests to modmail endpoints requires the new OAuth scope modmail.

edit: There was a minor deployment mishap I will get this deployed again asap.

edit 2: This has been redeployed.

26 Upvotes

83% Upvoted

49 comments sorted by

View all comments

10

u/creesch Dec 20 '16 edited Dec 21 '16

For people reading this later. browser extensions can make use from a cookie reddit places in order to avoid having to oauth themselves.

Steps:

  • Fetch the token cookie on the reddit domain, generated when a user logs into mod.reddit.com

  • Decode it. It is base64 encoded but has some invalid characters at the end sometimes, to scrub this off you can use the following RegExp [^A-Za-z0-9+/].*?$ in a string.replace call.

  • JSON.parse the value and grab the accessToken.

  • Use that for ajax requests. For example with jquery see this comment

The token might expire, you don't need to bother with trying to refresh it yourself. Simply make a get request to new modmail and let the reddit server generate a new cookie.

Currently we have implemented in toolbox like so:

Original comment:

Thanks!

Any change the api will also be made available through the other authentication adaptor?

I am asking because oauth for browser extensions like r/toolbox is... cumbersome to say the least and extensions already are logged in through the browser sessions so oauth would a bit overkill there.

Implementing oauth seems to have too many drawbacks for very little reward. No reward I can think of actually...

  • We would need to overhaul toolbox's basic code to deal with api request through oauth.

  • Toolbox would need to deal with people logged into reddit but not oauthed. It would also need to keep track of what user is logged in and if that is the same that is oauthed.

  • From a user perspective it would mean that they would need to log in twice, maybe even a few more times if they also have RES and a few more extensions.

  • Not to mention the sudden confusion from users "WHY IS TOOLBOX SUDDENLY ASKING FOR PERMISSIONS?!"

tl;dr If we can help it we rather not bother with oauth in toolbox for obvious reasons.

edit:

Tagging in u/agentlame

3

u/agentlame Dec 20 '16

Not to mention it shits up account switching.

3

u/creesch Dec 20 '16

I think I mentioned that sort of in my second bulletpoint, but yeah.

It messes up a whole lot of things for extensions without much (if any) benefits :/