Way to check Habbo is banned

[DavydeVries]

I have found a way to check if a Habbo is banned. You need to be authenticated, but that is hardly possible.

We use in this case:

• Habbo.com
• habboName: chinese

  Normal API request:

If you get an habbo like: https://www.habbo.com/api/public/users?name=chinese the response will be: {"error":"not-found"}. This response says three things banned, not exists.

Auth request:

If you are logged in to habbo create an new avatar with this name. Javascript calls this url: https://www.habbo.com/api/user/avatars/check-name?name=chinese This request will return in this case {"isAvailable":false} (or in other cases: {"isAvailable":true} or {"message":"authentication-needed"})

conclusion:

Normal API request	Auth request	Conclusion
{"error":"not-found"}	{"isAvailable":false}	banned, Habbo refuse to give data. But the habboName is in use.
{"error":"not-found"}	{"isAvailable":true}	habboName not exists, Habbo hasn't data. And the habboName is free.

I have tried to get authenticated, but Googles new recaptcha is trolling/blocking me..

DON'T USE YOUR OWN ACCOUNT!!! But no security risk here, if you use an demo mail address with no avatars and stuff on it. Something like auth@fansitename.extension with password like abcdef1.

So I think this is impossible to check. But maybe you have an idea about this? :smile:

[gerbenjacobs]

Actually, I think it's really just a name-check. To see if someone can register the name.

There is one way of finding out, I think. Look up the Habbo Avatar and if it's a valid image, then they exist. Otherwise its really not found.

[DavydeVries]

So in combination with {"error":"not-found"} and https://www.habbo.com/habbo-imaging/avatarimage?user=chinese you can say, this user is banned?

[gerbenjacobs]

Yep, that's as far as I know the most reliable way of checking this. Which brings another argument to the table for a Image URL validator in the code ;)

2015-12-07 10:10 GMT+01:00 Davy de Vries notifications@github.com:

So in combination with {"error":"not-found"} and https://www.habbo.com/habbo-imaging/avatarimage?user=chinese you can say, this user is banned?

— Reply to this email directly or view it on GitHub https://github.com/gerbenjacobs/HabboAPI/issues/15#issuecomment-162454912 .

[DavydeVries]

So it would be something like this:

Normal API request	Auth request	Avatar	Conclusion
{"error":"not-found"}	{"isAvailable":false}	Returns a valid image	banned
{"error":"not-found"}	{"isAvailable":false}	Returns a invalid image	habboName not allowed
{"error":"not-found"}	{"isAvailable":true}	Returns a invalid image	Habbo doesn't exists

Short version

Normal API request	Auth request	Avatar	Conclusion
failed	false	valid	banned
failed	false	invalid	habboName not allowed
failed	true	invalid	Habbo doesn't exists

[gerbenjacobs]

Alright, so to recap, this is possible with a combination of not-found and a extra request to validate the Avatar image. This means:

• It can only be used with a hotel + name (not hhid)
• It requires an extra HTTP call, each time

What remains is the following question; Is this something we want?

[DavydeVries]

Is this something we want?

It's a better response than not-found, but it adds no extra value. Because you can't collect habbo data and store this (in a DB). And set the status of this habbo on banned. So my answer first is no.

Only if you want to make sure that not-found is not-found, you should add this for fun and my answer will be yes.

So this is a feature that would be nice, but not necessary.

[gerbenjacobs]

Alright, I'll close it for now.

[Pandafuchs]

If you query https://www.habbo.de/api/public/users/uniqueID/profile and it's not working the user might have their profile on private.

If you can still access https://www.habbo.de/api/public/users/uniqueID this is confirmed. If you can't access it, they are banned.

[fortniteFN]

If you query https://www.habbo.de/api/public/users/uniqueID/profile and it's not working the user might have their profile on private.

If you can still access https://www.habbo.de/api/public/users/uniqueID this is confirmed. If you can't access it, they are banned.

Yes, but how could it be achieved with the username?