search

joshuatz / amazon-add-to-wishlist-bookmarklet

Raw code for a bookmarklet that lets you add products to your Amazon wishlist from almost any site.
https://joshuatz.com/projects/web-stuff/amazon-add-to-wishlist-bookmarklet/
8 stars 1 forks source link

Endpoint appears to be broken #1

Open joshuatz opened 5 years ago

joshuatz commented 5 years ago

Trying to add item via AJAX seems to have broken; my guess is the endpoint changed or the named params change. Need to look into this and fix.

joshuatz commented 5 years ago

Update: after some digging, it has become apparent that they have started locking down the endpoints with extra controls. For example, the main AJAX endpoint is now checking the Origin header, and has obviously whitelisted their own "Amazon Assistant" domains, including "https://horizonte.browserapps.amazon.com" (and https://horizonte.browserapps.amazon.com/atwl), and are not "wildcarding" the CORS Access-Control-Allow-Origin header.

Two requests made from Postman, with all headers and data identical except for the Origin header, proved this pretty unequivocally.

Since the request need to pass credentials (e.g. the signed-in cookie), I can't proxy the request through CORS-anywhere, or any other custom proxy. And spoofing the origin is not a good idea for several reasons, starting with it being flat-out not possible with a vanilla installation of Chrome and no tweaking.

At this point, it seems this is probably not going to be possible to get around. Amazon seems really determined to kill off third-party product integrations (I also noticed that they got around to removing some random pages that mentioned the old Universal Add To Wishlist features). If I have some more spare time, I might try to find another workaround, but I don't have high hopes and might just archive this repo...

joshuatz commented 5 years ago

After a little more digging, it does indeed appear as though this is going to be the final "nail in the coffin" for adding non-Amazon items to an Amazon wishlist, other than using the official Amazon Assistant extension. With all the old endpoints deprecated, and the only remaining functional endpoint I could find locked down by origin, and without an API, I can't see a way forward on this.

Summary of what I found:

Killed off pages:

Moving foward:

I will likely place this repo into "archive mode", update the README to reflect the status, and update my project page on my website to reflect this.

LoganDark commented 1 year ago

If there is any way to make this work - such as via Postman - then I would prefer it over installing Amazon's spyware on my computer. Is there any successor to this bookmarklet or any resources you can provide to make it possible to add external links to a wishlist by any means other than by using their extension?

Edit: I was able to create a separate browser profile just to contain the extension.

joshuatz commented 1 year ago

@LoganDark It definitely should be possible to do this from outside the browser (because then you can spoof origin easily), but it would be a pretty big pain - you would need to reverse-engineer the Amazon extension, pass around a cookie string for credentials, and probably a few other things I'm not thinking of. The last time I researched this (a few years ago), nothing had changed and I couldn't find any workarounds or easier approaches.

I'm still annoyed about this to this day (I'm not a fan of browser spyware either!)

EDIT: I suppose if I had to do this over today, I would probably rewrite this as a CLI instead of a browser extension. You could even pass the auth token / cookie from the browser to the CLI and persist it for as long as possible. Still would be a good chunk of work to rewrite all this and workaround Amazon's restrictions.

Edit: I was able to create a separate browser profile just to contain the extension.

Smart thinking!

mjsir911 commented 1 year ago

I have been able to successfully reverse engineer the add to wishlist flow here:

https://gist.github.com/mjsir911/a3bc9bb23775158e240dc56a9717f9f7

LoganDark commented 1 year ago

I have been able to successfully reverse engineer the add to wishlist flow here:

https://gist.github.com/mjsir911/a3bc9bb23775158e240dc56a9717f9f7

Thank you so much!

joshuatz commented 1 year ago

I have been able to successfully reverse engineer the add to wishlist flow here:

https://gist.github.com/mjsir911/a3bc9bb23775158e240dc56a9717f9f7

Nice work!