Allow users to build their own web pages similar to tool/aliyundrive/request.html to mitigate security concerns?

[yuguorui]

Please make sure of the following things

• I have read the documentation.
• I'm sure there are no duplicate issues or discussions.
• I'm sure it's due to alist and not something else(such as Dependencies or Operational).
• I'm sure I'm using the latest version

Alist Version / Alist 版本

v3.16.3

Driver used / 使用的存储驱动

aliyundrive open

Describe the bug / 问题描述

In order to ensure data security, are users be allowed to setup their own tool/aliyundrive/request.html?
Currently, I have not found the relevant code base, so I understand that the corresponding backend is closed source. Is this conclusion correct?

If the answer is yes, then the security auditing is needed for the relevant closed source code.

Reproduction / 复现链接

Not applicable.

Logs / 日志

Not applicable.

[welcome[bot]]

Thanks for opening your first issue here! Be sure to follow the issue template!

[xhofe]

The code of token exchange is available on https://github.com/alist-org/auth/blob/main/ali_open.go

If you have your own client, you can got your refresh_toekn by following https://www.yuque.com/aliyundrive/zpfszx/efabcs and fill in https://alist.nn.ci/guide/drivers/aliyundrive_open.html#client-id-client-secret to use your own directly.

[yuguorui]

Thanks for your quickly response and infomation provided sincerely.

But it seems do not include the routing of callback.html ?
https://github.com/alist-org/auth/blob/dfb75159ae9b77a26f884ec553ec63402ca9612f/setup.go#L32

func Setup(g *gin.RouterGroup) {
	initVar()
	g.GET("/ali/qr", Qr)
	g.POST("/ali/ck", Ck)
	g.POST("/onedrive/get_refresh_token", onedriveToken)
	g.POST("/onedrive/get_site_id", spSiteID)
	g.GET("/baidu/get_refresh_token", baiduToken)
        // ...
}

IIUC, in addition to the client_id, the redirect_uri also needs to be changed to my own URL to ensure the end-to-end security?

[xhofe]

• callback.html is just a static page, you can find the source in https://github.com/alist-org/docs/blob/main/docs/.vuepress/components/aliyundrive/Callback.vue
• When you apply for a client from the official staff of Aliyundrive, he will ask you to provide a redirect_uri. Or you can set redirect_uri while do authorize refer to https://www.yuque.com/aliyundrive/zpfszx/efabcs#obGxQ

[yuguorui]

I think my issue is solved. Thanks for your kindly response!