Sign in #712

Rehike doesn't use OAuth2 at all. To my knowledge, that is used by the mobile apps, TV apps, and Data API. We use Google's SAPISIDHASH authentication system, same as regular web YouTube.

Since the Rehike server intercepts all YouTube requests, it can just access all cookies that you have stored for the domain. When we make normal requests (non-InnerTube), then we can pass all the user's cookies to the YouTube request and the user will naturally be logged in. The same principle applies to InnerTube requests, but InnerTube requires an Authorization header with a SAPISIDHASH. Once that's supplied, all requests act on behalf of the user account just like Polymer, so we just make analogous requests.

The SAPISIDHASH value is a request-time hash generated from the current time of the client, the desired origin, and the user's SAPISID cookie.

One of the first checks we use to determine if the user is logged in is checking the availability of the SAPISID cookie. If it does not exist, then all additional signin-related code will be skipped.

If the cookie exists, then we retrieve information about the user's session. Most of this information is retrieved from https://www.youtube.com/getAccountSwitcherEndpoint, which returns objects with information about the active Google Account and all channels on the account. This endpoint does not contain all information that we need, so we also make a request to https://www.youtube.com/profile, which redirects to the channel URL of the currently-logged-into account; we use this request to determine the current UCID, which is used in some places across the UI. Because this requires two network requests to make, and the data doesn't change that often, we cache this information on disk for a faster user experience. If you are interested, you can read the source code here:

In PHP code, we use the SignIn::isSignedIn() API to determine if the user is logged in. In Twig code, we use rehike.signin.isSignedIn(). Both resolve to the exact same function.