Comment by lynxaegon

Interesting, i've never expected Spotify to put the access token in plain text in a script tag and they also set the id to "session". It's true, that this is not really important, since it's an anonymous token which is generated probably based on a session cookie, but they could have encrypted the json