search

carcabot / tiktok-signature

Generate tiktok signature token using node
733 stars 283 forks source link

Generates invalid video download / play URLs (403) #183

Closed vc0x closed 11 months ago

vc0x commented 1 year ago

Describe the bug: The items are fetched but the video urls are invalid.

To Reproduce:

Env:

All urls are from the first video of the profile: https://www.tiktok.com/@maddiejameslittle/video/7199539142814977286

Example video download url (downloadAddr):

https://v16-webapp-prime.tiktok.com/video/tos/useast2a/tos-useast2a-ve-0068c002/oMsIKbeprg6jnpgogZQDADCS5C0eQUSzH1TJKf/?a=1988&ch=0&cr=0&dr=0&lr=tiktok_m&cd=0%7C0%7C1%7C0&cv=1&br=4464&bt=2232&cs=0&ds=3&ft=4fUEKMew8Zmo00wZL64jVOPfDpWrKsdm&mime_type=video_mp4&qs=0&rc=aTs5OWRoZTxkPGZoZTtlNUBpanRtaDs6Zmp4aTMzNzczM0AyMTE2Y2IuNjYxLjQzNS1eYSNmX2EvcjRvNmhgLS1kMTZzcw%3D%3D&btag=80000&expire=1676561693&l=20230216093353B90FF4D6E2DD0402FB5C&ply_type=2&policy=2&signature=6071e8ffff304fea782730e729a36d79&tk=tt_chain_token

All generated video urls have the same host: https://v16-webapp-prime.tiktok.com

This requires the cookie tt_chain_token to be set which can be found in cookies under the browser devtools.

Here's the failed request made with axios:

const options = {
  method: "GET",
  headers: {
    "cookie": "tt_chain_token=7rIwE8szlWSpqe+Dg65ToQ==;",
    'referer': 'https://www.tiktok.com/',
  },
  url: 'https://v16-webapp-prime.tiktok.com/video/tos/useast2a/tos-useast2a-ve-0068c002/oMsIKbeprg6jnpgogZQDADCS5C0eQUSzH1TJKf/?a=1988&ch=0&cr=0&dr=0&lr=tiktok_m&cd=0%7C0%7C1%7C0&cv=1&br=4464&bt=2232&cs=0&ds=3&ft=4fUEKMew8Zmo00wZL64jVOPfDpWrKsdm&mime_type=video_mp4&qs=0&rc=aTs5OWRoZTxkPGZoZTtlNUBpanRtaDs6Zmp4aTMzNzczM0AyMTE2Y2IuNjYxLjQzNS1eYSNmX2EvcjRvNmhgLS1kMTZzcw%3D%3D&btag=80000&expire=1676561693&l=20230216093353B90FF4D6E2DD0402FB5C&ply_type=2&policy=2&signature=6071e8ffff304fea782730e729a36d79&tk=tt_chain_token',
};
axios(options).then((r) => {
  console.log(r);
});

Returns 403: Access Denied in the response.

Here's the successful request made with axios:

const options = {
  method: "GET",
  headers: {
    "cookie": "tt_chain_token=LbR2WOl2agjc02TJ0Mc5qg==;",
    'referer': 'https://www.tiktok.com/',
  },
  url: 'https://v16-webapp-prime.tiktok.com/video/tos/useast2a/tos-useast2a-ve-0068c002/oMsIKbeprg6jnpgogZQDADCS5C0eQUSzH1TJKf/?a=1988&ch=0&cr=0&dr=0&lr=tiktok_m&cd=0%7C0%7C1%7C0&cv=1&br=4464&bt=2232&cs=0&ds=3&ft=I~da4ogsD12NvbuAFZIxRkQSslJG-UjNS8-pi9&mime_type=video_mp4&qs=0&rc=aTs5OWRoZTxkPGZoZTtlNUBpanRtaDs6Zmp4aTMzNzczM0AyMTE2Y2IuNjYxLjQzNS1eYSNmX2EvcjRvNmhgLS1kMTZzcw%3D%3D&btag=80000&expire=1676558105&l=202302160834049C00A598B88E1C00A91A&ply_type=2&policy=2&signature=a4fed6552e4a8c5a0eceed73dafea273&tk=tt_chain_token',
};
axios(options).then((r) => {
  console.log(r);
});

Returns 200.

My guess is that instead of blocking the signer (javascript/signer.js), they're simply generating invalid urls.

Any help in resolving this would be appreciated.

Thanks

HH7H commented 1 year ago

you have to Add 'Range': 'bytes=0-99999999', and you useragent in Headers

vc0x commented 1 year ago

@HH7H Doesn't work. The cookie and referer are the only required headers (verified using curl, I know curl adds its own UA if one isn't provided), but I've tried it with the same UA when requesting for items. It fails with 403.

HH7H commented 1 year ago

@HH7H Doesn't work. The cookie and referer are the only required headers (verified using curl, I know curl adds its own UA if one isn't provided), but I've tried it with the same UA when requesting for items. It fails with 403.

try this example :)

import requests

API_URL = 'https://tt-service.onrender.com/api/get_video_info/'

REQ_data = {
    'url': 'https://www.tiktok.com/@maddiejameslittle/video/7199539142814977286',
    'Token': '74h5i-ai9ej-k56m2',
}

V_INFO = requests.post(url=API_URL,data=REQ_data).json()

TT_Headers = {
'Cookie': 'msToken=O_HoWIiYKlBgGpYoyOO5EfI4XJuTD-vwO2cZXKDcAvp8kp6Q2LPaXtOJcHindRUxlwghG-8G2w_EwR5nBf36QV7wOuhjkhTu42UHSDe-4xfOWMKdESRX_KhvjCyK-CqsIkJ027F1IxW0GxgKzQ==; _abck=CAC3F28F0B8F86D6A498F911572BBE4B~0~YAAQLLlNaJZdDzKGAQAATNCpQQnUueqeKNcrvG5hLmJDAA520J8L0ytT6tfCROQILvg9vNrW3lk/2XhrIKHRaoo5k9jJG9VlM2mevCHIDveiZar6jAQFmqSgiJpHd11zsfwtvsahbAWoYSWwbXm1CER+DS+K1K1webWN4vp/EV3Czi5ox9lh2KO2vts4nqGYltkK+D+Ajxje3o8DhFcyMJ5qu0IQHO3Wcfnq5ad/yxguf73ljkaQI4gMUfzS9m/CZHyW0LTFYDEflGEFxblCz7FzPl7Rh6A9jF/ls07vy7NTDuQCsFSUS2UyhMkb5TooF1uYwiWowv3DALwdhnFwWgkQ85fDH2A1HwTxO7GVnf/VPPauHVbTu5siNg3R6h0=~-1~-1~-1; odin_tt=e380eed9d14ae58de7c98decbbf17f0f87a24581a33ac1ce53e6f4f239e535f586f1f4fae068d30ea40012171a331cf9dc2d2ee3eaa9c124c96307eeb1feda443d90c595473a5cc0304437b40a072d98; bm_sv=3515A7ADC7F96917FBBBDA40ADE06086~YAAQLLlNaJVdDzKGAQAA2MupQRJpbrH9tNO9z0ePwkC/HIhiT+u+ppi9IDaZ9FjT2RpgW/k3WVIVAi+j5gBKNAzdHUcpqndCnnIYBUKfTWb2ABB47uFxoDivHAQ3J+r4AKOhO7tkrTLs60amcJPy1NvX0BqYlPqOXYJUcnj478IXoRGvaxZtq2eEFGaADmHBClZoLjNKShVAmPRA+1f1nfsajgBmHxsZ1nRy7sWJHHSnPjfB9mEdWoyptab6CIjuVQ==~1; store-country-code=iq; store-country-code-src=uid; store-idc=maliva; tt-target-idc=useast1a; ttwid=1%7C55v3RZnUtbcn_V0Oc6c3e-tVmg_hAzmOGyBr-TH2mls%7C1676138892%7C0707217adcc2f74b06eaf4fd0ff54b0103118adb4b82291fc71aadfe6df225e0; tt_chain_token=/IgTdacBF1i7xtXM+JuqMg==; ak_bmsc=0234211587CD72ED3353921DEFF286C2~000000000000000000000000000000~YAAQXfvOF2NTuhCGAQAAfIFhQRKrPPxuDJswXiu20L0LIFvG8/Mw/Q52zOCro6zuSZ3JsdyklxqT2jDW47diC/gEN6Yw1gEuTphQm7js93YHl3k27OLLXLG47GXt5pDYpMNE7lhGR/U9+BLKE3XO7YM6pVhOburxCXfsoDabsJarPRDqJqAXBzPLeNKPLg3A19I32J+btkPJJ5JnX2sGzvLs0/eNho+0QcGvxLyJ0wLUoTjpH+xb62l+ME4v0PvcyrDyB+cPzupps3rLl4tdDe/eLCmJNnpc2YMTyI2rFm0RHrj3URrvmrLX83YR4expN9r5DsMay7i8u5Czr1vRFwXYTz/02cOqdgWW9zDzButHkr1Cvb3WXTOzy84OChZbQqsGCmJ1I4vKgHjP0BrhVdu/WwRABtoFbdoMvE9E4uPrxZRsm/9T+Duy8/vpio5xNgUsWSOtmqs2Y1c2FrBRpPqo+3XGKANPC3GMzX89a/pwux6gq1dQtA==; bm_sz=1EC8334490064C0461F6E805CB3A8521~YAAQXfvOFzhTuhCGAQAA13dhQRIyZC3z7RJapoxEr8i2BR9oGQJSgjd94tGoquNZIII9DRWF9eRPbXZJclTiOoHrgqXCuMTnojO2uEk60NCo87r3BMgcgS+f+wxPPHTb7Yk2aQGn+FbWwPb1AZ+AgVQ78GlHqH2UJpKmh2jdX0ovdU/raBCf/csEnyAwVSHSMSTeqQvBgyycr649XTGla/eJDyUnbGxdwQ/OEB9+TwKWvzOpkMOavssn7RhJIIRC6s89Zf51rM3n+4zI8g8CDQCQfS2RdKkQsTPrjFP9UWgJ/OEnz30PwJJUK0udjmGcIcTxcWAA5xAA740=~3228741~4601399; tt_csrf_token=eLR0MaGt-mVxX0OUj5zjC2fOCU1YlZ8XShwI; tt-target-idc-sign=q9McJn6ne3EQfUhTo9w16eB21xKQyj5FF0A68uaRWNtcjsS28AnoWCOcRoup8_C9PS7oqPC8Qr2uIU0LnDUu2pzSpVN7tpe8v_Lj2w0L0I4XuQHxkO4MYOdITW8bWL-xi6oD8Gof6f2lNVKlItjzyG6h41sHvUQthpRf26HIfRM8xHgtkit1K6maHP3gJCuxVfTG9uf5wejXgtFDTS_JjyMTk6GbTFKVpRGeIKMaoUYVIet9xHTzFnzQ6a8wtWZSW-rm4InNW-UeTp5MuuLCXXkd4PGTsQPztfqq68icEvS9bztzZAiPGS3ohgnpgAt3GCfncWBrI8tXofNaWw1r4i8b-Bp-zXEo5nhgBPNz_6s8ETObWXEl5_5BGQKdo7YSB0ULIj3f4bMuwUIKBNVSM43maOWJW5IeeI-mGxpig9Ay3794qvCyn0LfQohDLoeaJQxI3vgbtlZWRYMgebfow-bqxvXoF3zGOOKHOQMaCfg_aeuVEBXqCq7d2TUVkvpU; cmpl_token=AgQQAPPdF-RO0rI5FGG0o90_-bDTP71Xf4QsYMmvnQ; sessionid=5a59ae004b844ee6948ff22d49191609; sessionid_ss=5a59ae004b844ee6948ff22d49191609; sid_guard=5a59ae004b844ee6948ff22d49191609%7C1675951266%7C5184000%7CMon%2C+10-Apr-2023+14%3A01%3A06+GMT; sid_tt=5a59ae004b844ee6948ff22d49191609; sid_ucp_v1=1.0.0-KDZiNjhjNjEwYTMyMjBhMDA4YWNkNmFlODg0MGM1MDBiODg5MWZkZDcKIAiGiMTk49j-g2IQovmTnwYYswsgDDCK9p-QBjgEQOoHEAMaBm1hbGl2YSIgNWE1OWFlMDA0Yjg0NGVlNjk0OGZmMjJkNDkxOTE2MDk; ssid_ucp_v1=1.0.0-KDZiNjhjNjEwYTMyMjBhMDA4YWNkNmFlODg0MGM1MDBiODg5MWZkZDcKIAiGiMTk49j-g2IQovmTnwYYswsgDDCK9p-QBjgEQOoHEAMaBm1hbGl2YSIgNWE1OWFlMDA0Yjg0NGVlNjk0OGZmMjJkNDkxOTE2MDk; uid_tt=0ead01a57e1eb118dcc5492d5495b8055ab0be7ee34b9d9b52575f14c92e18d2; uid_tt_ss=0ead01a57e1eb118dcc5492d5495b8055ab0be7ee34b9d9b52575f14c92e18d2; passport_csrf_token=e58450ad4939b49937b71a9d80967aa1; passport_csrf_token_default=e58450ad4939b49937b71a9d80967aa1',
'Connection': 'Keep-Alive',
'Range': 'bytes=0-99999999',
'Host': 'v16-webapp-prime.tiktok.com',
'Accept-Language': 'en-US,en;q=0.9',
'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15',
'Referer': 'https://www.tiktok.com/',
'Accept-Encoding': 'identity',
'X-Playback-Session-Id': '',
}

video = requests.get(url=V_INFO['video_url'],headers=TT_Headers).content

print(video)

open('video.mp4','wb').write(video)

make sure the userAgent the same in example

vc0x commented 1 year ago

@HH7H It works. Thanks. But can you generate the same example using a video url generated using the code in this repo? The point is to use this repo to fetch all items (which should return valid video download addresses for all items). If I were to use an external service like the one you provided in your example, I wouldn't be posting here.

Also, do you own the service at: https://tt-service.onrender.com ? If so, are you generating the url using the code in this repo or some other method? I just need to know that the urls generated by this repo are valid or not. If they are valid, there's something else that's required to successfully fetch the videos that I'm missing or have misconfigured on my end.

HH7H commented 1 year ago

@backwards221 You can get raw code by signing this url: (url not complete) https://www.tiktok.com/api/item/detail/?itemId={Video_ID} in this repo (signing are vaild in this repo) you can find the urllist Sorry I don't understand what you mean exactly because I don't speak English very well،

vc0x commented 1 year ago

@HH7H I've been able to get the video download url using: https://www.tiktok.com/api/item/detail/?itemId={videoId}. Thanks!

Right now, any video with the host: https://v16-webapp-prime.tiktok.com fails to download (with the required headers) even though that's what tiktok uses to play the video (when you hover a video).

Current Solution

The response from https://www.tiktok.com/api/item/detail/?itemId={videoId} contains a UrlList property which usually contains urls with two hosts:

The v16 one fails but the one with v19 succeeds (with the required headers).

azickri commented 1 year ago

@backwards221 , I have tried 2 urls v16 and v19, if the data is fetched from Chrome Browser, then the url is accessed in Igcognito Chrome Browser it becomes invalid.

Is there any solution for that? So that the URL can be accessed where

ajervin1 commented 1 year ago

@HH7H I've been able to get the video download url using: https://www.tiktok.com/api/item/detail/?itemId={videoId}. Thanks!

Right now, any video with the host: https://v16-webapp-prime.tiktok.com fails to download (with the required headers) even though that's what tiktok uses to play the video (when you hover a video).

Current Solution

The response from https://www.tiktok.com/api/item/detail/?itemId={videoId} contains a UrlList property which usually contains urls with two hosts:

The v16 one fails but the one with v19 succeeds (with the required headers).

This stopped working for me? Any idea why?