!lemmydev@lemm.ee may be able to help
post
FYI: Posted right now:
Note that you need to send your credentials, so you must trust the developer.
that's a major security risk. even the reddit predecessor uses app tokens (though with the death of 3pa idk if such things still work). that's why I want something that only runs on the client side.
tbf there's nothing stopping userscripts from stealing your jwt token in the cookie, which is just as big a security risk, but at least with userscripts you can read the source code.
my plan would be similar to that one in which I store the jwt with the scheduled posts, with the notable difference of the data remaining on the browser storage. i wont even need to see any passwords since the jwt is already in the cookie which the script could read off of.
all 5 comments