Way to check Habbo is banned

DavydeVries commented 8 years ago

I have found a way to check if a Habbo is banned. You need to be authenticated, but that is hardly possible.

We use in this case:

Habbo.com
habboName: chinese
Normal API request:

If you get an habbo like: https://www.habbo.com/api/public/users?name=chinese the response will be: {"error":"not-found"}. This response says three things banned, not exists.

Auth request:

If you are logged in to habbo create an new avatar with this name. Javascript calls this url: https://www.habbo.com/api/user/avatars/check-name?name=chinese This request will return in this case {"isAvailable":false} (or in other cases: {"isAvailable":true} or {"message":"authentication-needed"})

conclusion:

Normal API request	Auth request	Conclusion
`{"error":"not-found"}`	`{"isAvailable":false}`	banned, Habbo refuse to give data. But the habboName is in use.
`{"error":"not-found"}`	`{"isAvailable":true}`	habboName not exists, Habbo hasn't data. And the habboName is free.

I have tried to get authenticated, but Googles new recaptcha is trolling/blocking me..

DON'T USE YOUR OWN ACCOUNT!!! But no security risk here, if you use an demo mail address with no avatars and stuff on it. Something like auth@fansitename.extension with password like abcdef1.

So I think this is impossible to check. But maybe you have an idea about this? :smile:

gerbenjacobs commented 8 years ago

Actually, I think it's really just a name-check. To see if someone can register the name.

There is one way of finding out, I think. Look up the Habbo Avatar and if it's a valid image, then they exist. Otherwise its really not found.

DavydeVries commented 8 years ago

So in combination with {"error":"not-found"} and https://www.habbo.com/habbo-imaging/avatarimage?user=chinese you can say, this user is banned?

gerbenjacobs commented 8 years ago

Yep, that's as far as I know the most reliable way of checking this. Which brings another argument to the table for a Image URL validator in the code ;)

2015-12-07 10:10 GMT+01:00 Davy de Vries notifications@github.com:

So in combination with {"error":"not-found"} and https://www.habbo.com/habbo-imaging/avatarimage?user=chinese you can say, this user is banned?

— Reply to this email directly or view it on GitHub https://github.com/gerbenjacobs/HabboAPI/issues/15#issuecomment-162454912 .

DavydeVries commented 8 years ago

So it would be something like this:

Normal API request	Auth request	Avatar	Conclusion
`{"error":"not-found"}`	`{"isAvailable":false}`	`Returns a valid image`	banned
`{"error":"not-found"}`	`{"isAvailable":false}`	`Returns a invalid image`	habboName not allowed
`{"error":"not-found"}`	`{"isAvailable":true}`	`Returns a invalid image`	Habbo doesn't exists

Short version

Normal API request	Auth request	Avatar	Conclusion
`failed`	`false`	`valid`	banned
`failed`	`false`	`invalid`	habboName not allowed
`failed`	`true`	`invalid`	Habbo doesn't exists

gerbenjacobs commented 8 years ago

Alright, so to recap, this is possible with a combination of not-found and a extra request to validate the Avatar image. This means:

It can only be used with a hotel + name (not hhid)
It requires an extra HTTP call, each time

What remains is the following question; Is this something we want?

DavydeVries commented 8 years ago

Is this something we want?

It's a better response than not-found, but it adds no extra value. Because you can't collect habbo data and store this (in a DB). And set the status of this habbo on banned. So my answer first is no.

Only if you want to make sure that not-found is not-found, you should add this for fun and my answer will be yes.

So this is a feature that would be nice, but not necessary.

gerbenjacobs commented 8 years ago

Alright, I'll close it for now.

Pandafuchs commented 6 years ago

If you query https://www.habbo.de/api/public/users/uniqueID/profile and it's not working the user might have their profile on private.

If you can still access https://www.habbo.de/api/public/users/uniqueID this is confirmed. If you can't access it, they are banned.

fortniteFN commented 10 months ago

If you query https://www.habbo.de/api/public/users/uniqueID/profile and it's not working the user might have their profile on private.

If you can still access https://www.habbo.de/api/public/users/uniqueID this is confirmed. If you can't access it, they are banned.

Yes, but how could it be achieved with the username?

gerbenjacobs / HabboAPI