search

twrecked / pyaarlo

Asynchronous Arlo Component for Python
GNU Lesser General Public License v3.0
50 stars 30 forks source link

Optimizing Cloudflare undetection #144

Closed YpNo closed 2 months ago

YpNo commented 5 months ago

Hi,

I've made some optimization about Cloudflare bot detection. I've tried to be as human as possible during the auth authentication and I have managed requests with Cookies. I saw during the reverse engineering, the challenge process about getFactors and getFactorId has been changed. So, I tried to get it. Moreover, the "prime256v1" curve doesn't work anymore (on my side). So I define the the "secp384r1" as primary Curve.

I think this MR solve #120 and #121 (maybe more).

Let me know, and I wish this MR will be merged ;)

Regards.

YpNo commented 5 months ago

Ping @twrecked I think you're very busy but could you delegate or add some trusted contributors to help you managing your projects ? The Community need you :)

twrecked commented 4 months ago

Thanks for this. It looks pretty good. I'll just check it here and see exactly what it does.

I'm always wary of changing the Cloudflare stuff because what fixes my stuff doesn't necessarily fix other people's. For example, I have 2 setups here that need different configuration to get passed the cloudflare login.

YpNo commented 2 months ago

Hi @twrecked, Any news about your works on Cloudflare ? On my side, I cannot login without this PR. I am using https://github.com/kaffetorsk/arlo-streamer/ service associated with Frigate.

twrecked commented 2 months ago

Thanks for this. I'm just checking now.

I can't get the getFactorId call to return anything other than {'meta': {'code': 400, 'error': 9204, 'message': 'Browser is not trusted'}}; is it meant to act as a noop?

YpNo commented 2 months ago

Thanks for this. I'm just checking now.

I can't get the getFactorId call to return anything other than {'meta': {'code': 400, 'error': 9204, 'message': 'Browser is not trusted'}}; is it meant to act as a noop?

Yes, just for the noop. I am not sure that, precisely at this point, the OPTION call is needed or not but i've wanted to reproduce same calls my browser did. The 400 error code appears beacause of wrong user-agent has been sent (for him). Either we let as is for now, or we can try to get a 200 HTTP code returned.

twrecked commented 2 months ago

I merged it. We'll see how it goes... and I feel it's always good to line everything up as close as possible so maybe the extra NOOPs will help.

YpNo commented 2 months ago

Great, Thanks 👏 I will check if I can come over this noop as soon as possible.