search

pgrimaud / instagram-user-feed

This is a scrapper to easily fetch any feed and interact with Instagram (like, follow, etc.) without OAuth for PHP.
MIT License
873 stars 136 forks source link

5.6beta - Send/Enter Security Code #48

Closed benjaminpick closed 4 years ago

benjaminpick commented 5 years ago

After seeing the IP locked (Ref #45) I am trying 5.6beta.

Although I pass in the correct credentials, it is throwing the exception 

Instagram Error: Client error: `POST https://www.instagram.com/accounts/login/ajax/` resulted in a `400 Bad Request` response:
{"message": "checkpoint_required", "checkpoint_url": "/challenge/12345/0lARIAzCSu/", "lock": false, "status": "fail (truncated...)

Also, when I log in manually, it first tries to unlock the IP (?) via a security code sent by Email, I don't think this will work on the server, will it? Can I disable this security feature in my preferences? (Two-Factor-Auth is already disabled.)

pgrimaud commented 5 years ago

Hi @benjaminpick,

Hmmmm, try to resolve the checkpoint_url and complete verification manually. I never seen this verification before.

pgrimaud commented 5 years ago

image I guess you can validate a new connection here.

Instagram.com from a desktop > Login > Settings > Login Activity

benjaminpick commented 5 years ago

I'm not very good at this kind of reverse engineering, I regret ... What I've tried:

sending a GET request to the Checkpoint URL (using the UA and Cookie headers) -> Response "Login Required", so no good. sending a POST request to the Checkpoint URL (using the UA and Cookie headers, including the credetials) -> shows the HTML version of the Security Code page. Better. I have posted this code to https://gist.github.com/benjaminpick/c947b81641bc598a08151eb269aad440 if somebody wants to improve it.

So I've uploaded it to the server, and tried to activate the connection via the instagram account. Eh ben non, it does ask me whether it was me but the next login try also has the Security Code page. Actually, locally when I log out and log in again, it also ask me for the security code again (even though neither IP nor UA has changed.) So we would have to confirm EVERY server login via email which does not make sense for a server API.

I will use the 4.0-Method for now.

pgrimaud commented 4 years ago

Hello, I released a new version (6.0). Could you upgrade to this one?