HTTP错误401使用Python请求软件包与用户代理标头未经授权

发布于 2025-01-24 23:44:55 字数 1726 浏览 4 评论 0原文

我正在尝试反向工程网络应用程序。到目前为止,使用浏览器上的“检查工具”,我设法使用Python登录了网站,并使用了应用程序的多个部分。

简短示例:

# Log in 
session = requests.Session()
login_response = session.request(method='POST', url=LOGIN_URL, data=build_login_body())
session.cookies = login_response.cookies
# Call requests post method
session.request(method='POST', url=URL_1, data=build_keyword_update_body(**kwargs),
        headers={'Content-type': 'application/json; charset=UTF-8'}
)

但是,有一个URL(url_2),如果我只通过content-type标头,则会得到'http 400不良请求错误'。为了解决此问题,我复制了检查工具中使用的所有标题,并提出了以下要求:

session.request(
    method='POST',
    url=URL_2,
    data={},
    headers={
        'accept': '*/*',
        'cookie': ';'.join([f'{cookie.name}={cookie.value}' for cookie in session.cookies]),
        'origin': origin_url,
        'referer': referer_url,
        'sec-ch-ua': 'Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100',
        'sec-ch-ua-mobile': '?0',
        'sec-ch-ua-platform': 'macOS',
        'sec-fetch-dest': 'empty',
        'sec-fetch-mode': 'cors',
        'sec-fetch-site': 'same-origin',
        'content-type': 'application/json; charset=UTF-8',
        'accept-language': 'en-GB,en-US;q=0.9,en;q=0.8',
        'accept-encoding': 'gzip, deflate, br',
        'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36'
    }

上面的标题给我401个未经授权的错误。我发现,如果删除用户代理标头,我会收到一个不好的请求,但是当我添加时,我会得到401未经授权的错误。

我尝试在所有请求的标题(包括登录)中添加相同的用户代理,但这无济于事。我还尝试将HTTPBASICAUTHhttpdigestauth对象将其分配给session.auth,但这无济于事,但这无济于事任何一个。

任何人都知道会发生什么,我该怎么做才能解决这个未经授权的访问错误?

I am trying to reverse engineer a web app. So far, using the inspect tool on my browser, I have managed to log in the website using python and use multiple parts of the application.

Short example:

# Log in 
session = requests.Session()
login_response = session.request(method='POST', url=LOGIN_URL, data=build_login_body())
session.cookies = login_response.cookies
# Call requests post method
session.request(method='POST', url=URL_1, data=build_keyword_update_body(**kwargs),
        headers={'Content-type': 'application/json; charset=UTF-8'}
)

However there is one URL (URL_2) for which if I only pass the content-type headers then I get a 'HTTP 400 Bad Request Error'. To work around that, I copied all the headers used in the inspect tool and made a request as follows:

session.request(
    method='POST',
    url=URL_2,
    data={},
    headers={
        'accept': '*/*',
        'cookie': ';'.join([f'{cookie.name}={cookie.value}' for cookie in session.cookies]),
        'origin': origin_url,
        'referer': referer_url,
        'sec-ch-ua': 'Not A;Brand";v="99", "Chromium";v="100", "Google Chrome";v="100',
        'sec-ch-ua-mobile': '?0',
        'sec-ch-ua-platform': 'macOS',
        'sec-fetch-dest': 'empty',
        'sec-fetch-mode': 'cors',
        'sec-fetch-site': 'same-origin',
        'content-type': 'application/json; charset=UTF-8',
        'accept-language': 'en-GB,en-US;q=0.9,en;q=0.8',
        'accept-encoding': 'gzip, deflate, br',
        'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36'
    }

The headers above give me a 401 Unauthorized error. I found out that if I remove the user-agent header I get a bad request, but when I add it I get the 401 Unauthorized error.

I tried adding the same user-agent in all requests' headers, including login, but it didn't help. I also tried passing an HTTPBasicAuth or HTTPDigestAuth object to the request parameters as well as assigning it to session.auth, but that didn't help either.

Anyone has a clue what could be going on and what I can do to get around this unauthorized access error?

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。
列表为空,暂无数据
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文