HTTP 403 when logging in using Python

[CrymanChen]

Hey guys,
Just met a problem of logging in.
I mean, not about downloading videos but I can't even log in.

Everything went normal on Chrome, and the parameters are not fastly-expired. But on Python, always Access Denied.

Would anyone be willing to help?
Password will be changed in the near future in case of security.
---[base64 encoded]---
Email: [deleted]
Password: [deleted]
---[base64 encoded]---

My debugging code:

from curl_cffi import requests

# Necessary for me.
proxies = {'http': 'http://127.0.0.1:7890', 'https': 'http://127.0.0.1:7890'}

headers = {
    'sec-ch-ua': '"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"',
    'sec-ch-ua-platform': '"Windows"',
    'Referer': 'https://watch.foxtel.com.au/app/',
    'DNT': '1',
    'sec-ch-ua-mobile': '?0',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36',
    'Content-Type': 'application/x-www-form-urlencoded',
}

data = 'versionNumber=0.1&...(truncated)'

response = requests.post('https://watch.foxtel.com.au/app/api/auth.class.api.php/logon/296', headers=headers, data=data, proxies=proxies, impersonate='chrome120')
print(response.status_code)

P.S.
1. In this thread, I used curl_cffi to disguise myself as Chrome. So here I used the same module in case this site needs tls fingerprint or something else.
2. After the login on Chrome was successful, I re-played that login request for several times, and the response was HTTP 200 (OK). But when turning to Python, an HTTP 403 returned.
3. An Australian IP needed.

[CrymanChen]

Update:
1. Using selenium to create a Chrome window and then tried to log in:
Returned 403

[Attachment 77970 - Click to enlarge]
2. In a normal Chrome window:
Returned 200

[Attachment 77971 - Click to enlarge]

Wh...why? This is so strange��.

[stabbedbybrick]

After a quick look, I saw that there's a prelogin (https://watch.foxtel.com.au/app/api/auth.class.api.php/prelogin/296?) that returns a secret:

<?xml version="1.0" standalone="yes" ?>
<array>
    <secret><![CDATA[42c3e47da29e4497adcd72294b3f0d6b]]></secret>
</array>

This secret is then probably required in the login request along with the credentials. I don't have the time to investigate further, but it should at least help you along.

[CrymanChen]

After a quick look, I saw that there's a prelogin (https://watch.foxtel.com.au/app/api/auth.class.api.php/prelogin/296?) that returns a secret:

<?xml version="1.0" standalone="yes" ?>
<array>
    <secret><![CDATA[42c3e47da29e4497adcd72294b3f0d6b]]></secret>
</array>

This secret is then probably required in the login request along with the credentials. I don't have the time to investigate further, but it should at least help you along.

Yes sir, this secret value is used to hash the password.
---
From my investigation, after the prelogin is successful, a cookie named "bm_sv" will change, and we carry the new "bm_sv" cookie to login.
But I tried to print all the cookies before and after the prelogin, and found that they were the same.

[CrymanChen]

Problem solved. Thank y'all.