How to send json POST request using requests if the website uses jwt?

user_8958573 0
Viewed 158

i am trying to send POST request to login to this URL , i first checked the network tab and found out the the post request is being sent to this

url : https://api-my.te.eg/api/user/login?channelId=WEB_APP

and the request payload is:

{
   "header":{
      "timstamp":0,
      "customerId":null,
      "msisdn":null,
      "messageCode":null,
      "responseCode":"1200",
      "responseMessage":"Your Session has been expired, please sign in to continue",
      "locale":null,
      "referenceId":null,
      "channelId":null,
      "responeAdditionalParameters":null
   },
   "body":null
}

Here is the code :

import requests
import calendar
import time
#Here i tried to send a generated timestamp, idk if this is needed or not
ts = calendar.timegm(time.gmtime())
loginUrl = 'https://api-my.te.eg/api/user/login?channelId=WEB_APP'
values = {
    "msisdn": MobileNumberID,
    "timestamp": str(ts),
    "locale": "Ar"
}

data = {
    "password": PasswordID
}

url = requests.post(loginUrl , data=data , headers=values)
print(url.text)
python-requests python json
1 Answers

I looked at the site and in the body they are also passing a header property in the data

So you should use 

data = {
  "header": {
    "msisdn": "024568478",
    "timestamp": "1592337873",
    "locale": "Ar"
  },
  "body": {
    "password": "PJGkRJte5ntnKt9TQ8XM3Q=="
  }
}

and in headers you should pass the native headers probably something like:

headers={'Content-Type': 'application/json', }

but i also see by when you log into this site they pass a jwt argument in the headers. Looks like its some sort of built in security. So it looks like you can not use this API. Its only for the backend of this site.

Did you search the site to see if they have API documentation, maybe their is written how you can calculate the value for jwt?

EDIT:

When you get the login working this is. How to use sessions in python requests:

s = requests.Session()
data = {"login":"my_login", "password":"my_password"}
url = "http://example.net/login"
r = s.post(url, data=data)

If you do not get arround the jwt. You can uses Selenium in python. It works by automating a webbrowser. So you can open chrome tell it wich page to load, fill in your login form and read the html of elements in the browser. This will work on 95% of the websites. Some even have protections against it. Some sites use cloudflare, they are protected from selenium automation.

user_102136350
Related