Why Python Login working without Login/Password

Viewed 268

This code with a little login screen works when logging in to my Twitter Account. The first (GET) Request reads the data. The first (POST) Request sends the login data. These are the informations im sending:

{'session[username_or_email]': '', 'session[password]': '', 'authenticity_token': ''}

When i start the program the first time i get Status 200 - ok.

When starting the program the second time, i get Status 200, too. BUT WITHOUT having my credentials ENTERED (Leaving login and password field empty).

I tried this in Eclipse 2019-12 and VSCODE with same behaviour. I also cleared Chrome Browser Cache and Cookies and in Eclipse Preferences too. I also tried to clear Cookies with session.cookies.clear() after successfull login but it changed nothing.

Do you know why this is happening or where i have to clear the cookies so i have to enter the credentials every time when restarting the script?

import requests
from bs4 import BeautifulSoup as soup
from tkinter import *
from functools import partial

LOGIN_URL = 'https://twitter.com/sessions'

def loginToSite(username, password):
    session = requests.sessions.Session()
    req = session.get('https://twitter.com/session').text
    html = soup(req, features="lxml")
    token = html.find("input", {"name": "authenticity_token"}).attrs['value']

    # login works despite missing login and pass!!!
    login_data = {'session[username_or_email]': username.get(),
                  'session[password]': password.get(),
                  'authenticity_token' : token}

    response = session.post(LOGIN_URL, data = login_data)
    if response.status_code == 200:
        print("Login Successful: ", response.status_code)
        print(login_data)
        #session.cookies.clear()
        sys.exit(1)
    else:
        print("Login failed: ", response.status_code, response.reason)
        sys.exit(1)

#window
tkWindow = Tk()  
tkWindow.geometry('400x150')  
tkWindow.title('Tkinter Login Form - pythonexamples.org')

#username label and text entry box
usernameLabel = Label(tkWindow, text="User Name").grid(row=0, column=0)
username = StringVar()
usernameEntry = Entry(tkWindow, textvariable=username).grid(row=0, column=1)  

#password label and password entry box
passwordLabel = Label(tkWindow,text="Password").grid(row=1, column=0)  
password = StringVar()
passwordEntry = Entry(tkWindow, textvariable=password, show='*').grid(row=1, column=1)

loginToSite = partial(loginToSite, username, password)

#login button
loginButton = Button(tkWindow, text="Login", command=loginToSite).grid(row=4, column=0)

tkWindow.mainloop()

Here is an Example of my Problem:

I run the script from command line: enter image description here

Then the Login screen appears and i leave the fields blank enter image description here

After submit im geting result 200 with the found authenticity_token from line

token = html.find("input", {"name": "authenticity_token"}).attrs['value'] 

enter image description here

1 Answers

Where did you get this LOGIN_URL = 'https://twitter.com/sessions' from? Why do you think that you can send a POST request here in order to log in? Did you read it in twitter docs?

You get 200 status because you will always get 200 for this URL, you can even send some bogus data in the payload, it will return 200 status.

Related