Other users' activities being returned on /me/activities endpoint

[dewhaskins]

Title: /me/activities returns activities that do not belong to the authenticated user

Issue found of: September 20th, 2020

Endpoint(s):

• GET /me/activities

Scope(s):

• OAuth 2 access token

Steps to reproduce:

curl --request GET \
  --url 'https://api.soundcloud.com/me/activities'

Expected behaviour:

A collection of activities should be returned that all belong to the authenticated user

Actual behaviour:

A collection of activities is returned but only some belong to the authenticated user - most are other users' activities. This also affects the /me/activities/all/own endpoint

[dewhaskins]

I had a closer look at this and it appears that the endpoint is returning activities from other users that the authenticated user follows, as well as their own activities

[youssefhassan]

I will look into this, can you share your app name or username that created the app to debug the issue? thanks for reporting

[dewhaskins]

I will look into this, can you share your app name or username that created the app to debug the issue? thanks for reporting

Thanks, app name is SC Assistant

[dpreussler]

@dewhaskins do you still see this?

[dpreussler]

@dewhaskins any update?
We cant reproduce and the cache headers are also set correctly from our side

[dewhaskins]

@dewhaskins any update?
We cant reproduce and the cache headers are also set correctly from our side

Hi sorry for slow reply, I haven't looked at the API for months but as far as I'm aware it is working correctly now. I will find some time to have a better look this week and confirm.

[dewhaskins]

@dewhaskins any update? We cant reproduce and the cache headers are also set correctly from our side

Finally got a chance to have a look at this and I can confirm I am still seeing other user's activities in the response - as before it appears to return activities of all users the authenticated user is following instead of just their own activities. It doesn't appear to be a caching issue as the activities are all fresh that are returned in the first response.

[dpreussler]

@dewhaskins is that consistent? Can you send the user url or id of the user where you see that?

[dewhaskins]

@dewhaskins is that consistent? Can you send the user url or id of the user where you see that?

@dpreussler Seems to be consistant although I've only looked at it now for the first time in months but it seems to behave as it did back then.

It is my own user id I am testing on - 76879163.