[Helix] Able to Retrieve Subscribers List Without Scope

[Six]

Bug

I am able to retrieve my subscriber list when providing a Bearer token that was created without the scope channel:read:subscriptions. I double checked multiple times to make sure the right Bearer token was being passed, and even made a fresh token to be 100% sure the token was created with no scopes.

Test

[TestMethod]
public void
GetBroadcasterSubscribersPageAsync_Authentication_ScopesMissing()
{
    BroadcasterSubscribersParameters parameters = new BroadcasterSubscribersParameters();
    parameters.broadcaster_id = UserCache.logins["rokuhodo"].id;

    IHelixResponse<DataPage<Subscription>> response_1 = TwitchApi.OAuth.GetBroadcasterSubscribersPageAsync(Authentication.bearer_token_no_scopes, parameters, Settings.errors).Result;
    Assert.AreEqual(HttpStatusCode.Unauthorized, response_1.status_code);
    Assert.IsNotNull(response_1.exception);
    Assert.IsInstanceOfType(response_1.exception, typeof(HelixException));
}

Response

[BarryCarlyon]

You only returned one subscription.

Sounds like you did

Reference

But

Users can only request their own subscriptions.

You only managed to get your own subscription. And it’s not scoped to get your own subscription to a channel? So the docs are wrong the linked fetch is a optional scope instead? Since you only loaded your own subscription

[Six]

I didn’t supply any query parameters beyond the broadcaster_id, so all subs should have been returned. I just have no subs since I haven’t streamed in probably a half a year at this point. And technically every affiliate/partner is subscribed to themself, at least according to Twitch. If you go to the page that lists all the channels you’re subbed to, your own channel will be listed there.

[jbulava]

Thanks for bringing this to our attention. I am able to reproduce the same behavior if the client_id is associated with the account that is also authenticating (i.e. I own the app and I’m authenticating myself). If I authenticate myself with a client_id created in a different account and try to get the sub list without the scope, it fails as expected.

I’ve inquired with the API team about this behavior to see if it is intended behavior for the developer’s account to not need the required scope.