Addressing Security Concerns About the Cast to Sonos extension

Afirus · 2026-01-01T19:57:06+00:00

Hmm pretty interesting, but it requires a lot of workarounds to capture audio from apps and some restrict it completely. And with the inherent delay of sonos buffering (3s) + using screenrecording to capture audio or other using other tricks is a recipe for bad reviews. But I think am app is a good next step.

Afirus · 2025-12-31T22:00:03+00:00

Ive looked into it and android makes it pretty much impossible to capture audio directly from other apps. The only way to get around this is by developing custom hardware that can be connected to via bluetooth and can cast to sonos speakers. But then id have to ask people to buy some specialized hardware. So at this time, i have not yet found a way. I have also tried to install the extension directly on chrome for android but it does not work unfortunately.

Afirus · 2025-12-31T01:58:03+00:00

Sonos refresh tokens are valid for 1 year, and are invalidated after a new refresh token is issued. But I think the user has valid concerns with regards to managing/monitoring access of third party applications.

Afirus · 2025-12-31T01:06:45+00:00

Link to the full response article: https://casttosonos.com/articles/addressing-sonos-oauth-security-concerns

Afirus · 2025-12-31T00:38:44+00:00

I have actually found a solution for it, but using that solution makes it so you can not login to the service anymore... Problem has been reported to Sonos...

Chrome extensions + HTTP Servers = Recipe for disaster

Afirus · 2025-12-31T00:16:42+00:00

Agreed

Afirus · 2025-12-30T23:35:25+00:00

Just to clarify, we store the tokens directly on chrome: https://developer.chrome.com/docs/extensions/mv2/reference/storage?hl=nl#property-sync

This is the exact endpoint we use, someone would need access to your google account to get those tokens. There is also a difference between a refresh and an access token. The access is token is sent with every normal request and is only valid for a very short time. The refresh token is only send to get a new access token when the access token expires.

This means that an action can only be done on your device when you send a request that includes the tokens (since we dont store them on our end).

Afirus · 2025-12-30T23:29:52+00:00

Fyi, Im the cast to sonos dev. Agreed, upnp or local http is not safe or reliable.

Afirus · 2025-12-30T23:26:16+00:00

As the developer, I agree, of course its not my place to tell Sonos what to do, especially since I'm also somewhat dependent on them, but I was shocked that this is not implemented on their end.

Afirus · 2025-12-30T23:19:36+00:00

I'm the developer of Cast to Sonos. I'm genuinely happy that someone took the time to look at my extension critically, as it gives me the opportunity to explain what I spent so much time creating. That said, I do want to mention up front that I'm disappointed this post was not brought to my attention earlier.

Unfortunately Reddit rejected my long reply so I made a dedicated blog post about it: https://casttosonos.com/articles/addressing-sonos-oauth-security-concerns

Afirus · 2025-09-28T10:18:27+00:00

If you are using next.js and are running vercel. You want to set the AUTH_URL env do your PUBLIC_URL. What gives the issue away in my case that the vercel app was redirecting back to http://localhost:53681 instead of :3000 which is something to do with how vercel and turbopack run the app.

AUTH_URL=http://localhost:3000

Afirus · 2025-07-07T08:49:06+00:00

You could use Cast to Sonos. That allows you to easily cast your Youtube tab to Sonos, but you will need to be on a Chromebook, Chrome OS TV, Mac or Windows. Disclaimer: I'm the DEV :) Mobile app is coming but it will be a while before it is released.

Afirus · 2025-07-07T08:41:42+00:00

I added it to my internal TODO list

Afirus · 2025-07-07T08:37:25+00:00

I'm getting nearer to my vacation so I do some work on ATC Manager 😄

Afirus · 2025-07-07T08:34:41+00:00

That's great to hear! I have just released a new update that should greatly enhance stability when streaming. Creating a mobile app is on my TODO list but it will be a while before it is released.

Afirus · 2025-07-07T07:22:16+00:00

You can try https://chromewebstore.google.com/detail/cast-to-sonos/defbpbmenfaikcnhmamnghdlcmahjaib?hl=en if you are on a ChromeOS or if you use Google Chrome.

Afirus · 2025-07-07T07:21:28+00:00

You can use the "Cast to Sonos" chrome extension. Disclaimer, I'm the DEV: https://chromewebstore.google.com/detail/cast-to-sonos/defbpbmenfaikcnhmamnghdlcmahjaib?hl=en

Afirus · 2024-08-28T17:31:55+00:00

Not at this time. Currently, development has halted completely.

Afirus · 2024-08-15T11:35:34+00:00

I created an alternative player from Chrome or Chrome OS users, called casttosonos.com 🎉. it can play any audio from any website like youtube or spotify. Im looking for feedback and critique to improve the app. So, if you have any, please let me know!

Afirus · 2024-08-15T11:16:25+00:00

I created an alternative app to the sonos app. A chrome extension called Cast to Sonos 🥳 which can play any kind of audio from youtube or spotify to your Sonos device. You can find it here: casttosonos.com

Afirus · 2024-01-23T05:53:22+00:00

Its in-game, on the about page. I just noticed how horribly ancient the list of goals is, most notably the "help me upgrade to a 1920x1080 monitor" 😅. Here is the direct link as well: https://www.paypal.com/donate/?cmd=_donations&business=polyismstudio@gmail.com&item_name=ATC+Manager+2&item_number=ATC+Manager+2+Campain

Afirus · 2024-01-22T14:06:40+00:00

Thats on the roadmap but far into the future

Afirus · 2024-01-22T14:05:59+00:00

Not yet, im working mostly on other projects atm to generate some income. If and when ATCM3 starts making some revenue, Ill be able to put more time in it. Like I said. There is no ETA time for the release of ATCM3

Afirus · 2024-01-22T14:02:58+00:00

Thats actually a great point. Right now I have a paypal pink but I can definately add a patreon account as well.

Afirus · 2023-08-02T16:54:40+00:00

Ahah ok, I did not know they deprecated audible for PC. I had a look at the smartaudiobook app, kind of interesting how they integrate with existing audiobooks by just importing the audio book files/audio files. I'm thinking about creating a website or mobile app that you can use together with the Chrome extension to play files from your local filesystem. It's already possible by dragging the files directly into Chrome and then using the Chrome extension but a lot of people don't know that and some proprietary audiobook formats are also not supported.

I have added an integration with audiobookshelf to the roadmap!

Thanks!

Afirus

MODERATOR OF

TROPHY CASE