Access without login

[MiniGod]

I'm not sure if its a bug by Spotify, but it is possible to navigate through http://play.spotify.com/ without authenticating.

Opening http://play.spotify.com/ directly will give you a static signup page with background covered with albums.

If you go through open.spotify.com (sets the sps (spotify session?) cookie), you'll notice that the play UI loads behind the signup overlay.
If you hide/delete #overlay, everything works except playing songs, and crud'ing user data (playlists). You can even start a radio, and skip through it to get suggestions, etc (but it wont play).

It would be great to be able to access all this data without having to .login?

[adammw]

This is actually what the Spotify#anonymousLogin() method is supposed to do, however it seems that Spotify have changed the way that we can access it so some of the code should really be updated.

Previously, any request to play.spotify.com returned null credentials until the client authenticates with a HTTP POST to /xhr/json/auth.php, which then sets the session up with credentials that can then be used to open a WebSocket connection. The anonymous login was reverse engineered from the official client source code which sets the login type to anonymous when making the POST.

This method stopped working a while ago, but now testing it again it seems like it is working again with the latest changes. What you have noticed however, is that now, new requests to play.spotify.com provide an anonymous session credentials anyway rather than null credentials. This occurs on any landing page, not only those redirected from open.spotify.com. So, although the current code works, ideally it could be refactored to utilise the existing anonymous credentials from the landing page request and save one RTT and not perform the POST in that case.

I've noticed that there's a sessionType key in the settings which is set to anonymous, which could help, as could checking if the credentials are null before skipping the second authentication POST step in the anonymous login.

In terms of actually using this, a quick example that I've tested is:

var uri = 'spotify:track:6tdp8sdXrXlPV6AZZN2PE8';
var spotify = new Spotify();
spotify.anonymousLogin(function(err){ 
  if (err) throw err;
  spotify.get(uri, function (err, track) {
    if (err) throw err;
    console.log('Open %s in your browser for a 30 second preview of: %s - %s', track.previewUrl, track.artist[0].name, track.name);
    spotify.disconnect();
  });
});

As you discovered, anonymous users don't seem to be able to play any tracks, all mp3 requests return a {"error":[12,12,""]}. I think they may have been able to previously, but they definitely don't seem to be able to any more, so users will most likely need to login to access that the actual MP3s. However, if it's just the metadata or 30 second previews your after then this could be a useful feature.

[adammw]

More research and I'm still confused about this feature. It seems now that you were correct, in that the landing page only provides anonymous credentials when you have the cookie from open.spotify.com

Also, the previous method going via /xhr/json/auth.php seems to be broken at the moment and is returning 500 errors for anonymous login attempts.

I did however find a legitimate way of consistently triggering the anonymous session logic in the official player, if you are logged in to Facebook, but not connected to the app (as in have not authorised the Spotify app), and navigate to https://play.spotify.com/?flow=fb then it will try to create an anonymous session with a POST to /xhr/json/auth.php (the same method that we were previously using).

Assuming that the 500 errors will go away and be fixed eventually as it is actually legitimately written into the code, and considering that going to open.spotify.com to redirect to the landing page is an extra hop/redirect, the number of hops would be about the same as the landing page + xhr POST combo we currently have, and is also simpler as it shares the same code for all three login types, so I don't think that any code changes are needed.

Reopen this issue if there's anything else...

[adammw]

Good news everyone! /cc @TooTallNate @MiniGod

1. The PHP auth endpoint has stopped sending 500 errors for me now, so anonymous works now in the library but only for reading actions, you can't create/star/like/share anything or play any tracks.

2. Did some more "research" (cough; cough), actually got a track playing in the official player in anonymous mode.
   

The secret sauce is Facebook interestingly, but not in the way you'd expect. There's code in the player to drive users who haven't got a Spotify account to use the app but incentivise them to sign up with a banner, as shown in the screenshot above. So to get to anonymous mode in the offical player, two (or three) steps:

1. Login to Facebook with a Facebook account (any account will do, Spotify will never know/care which account you use)
2. (Optional, only required if you've previously linked the Facebook account with Spotify) Go to https://www.facebook.com/settings?tab=applications and find Spotify, select it and go Remove App
3. Navigate to http://play.spotify.com/redirect/facebook/notification.php?album=http://open.spotify.com/album/2mCuMNdJkoyiXFhsQCLLqw&song=http://open.spotify.com/track/6JEK0CvvjDjjMUBFoXShNZ and wait for it to load up and start playing.

Sometimes the PHP script still returns a 500 error and the player fails with some sort of "This is taking a long time..." error with a "click here" link which takes you back to the regular login screen. Rather than clicking the link, navigate to the url again and hopefully you will get a anonymous session and it will start playing.

So what happens is the notification.php sets a plp cookie. Then you load up the landing page, which gives you the tracking id, csrftoken, etc. and POST to the auth.php, which returns a 500 error. But then if you load up the landing page again, the credentials are there because the POST actually worked.

I've tried playing tracks as well as Radio, both seem to work but there's a time cap. (Coincidently, that's the error 12 that we were seeing previously when we were trying to play tracks with an anonymous account).

Expect some PRs related to this...