在Unifi（UDMPRO）环境中用PowerShell设固定IP遇403错误求助

以下是导致403 Forbidden错误的常见原因及对应修复方案：

1. 缺失CSRF Token请求头 #

Unifi API的非GET请求（如PUT/POST）必须携带X-Csrf-Token头，该Token会在登录成功后存入Session Cookie中。当前代码未添加此头，导致权限验证失败。

修复：登录后从Session中提取CSRF Token，添加到PUT请求的Headers里：

# 登录后获取CSRF Token
$csrfToken = $Session.Cookies.GetCookies($Controller)["csrf_token"].Value

# 构造请求头时加入CSRF Token
$header = @{
    "accept" = "application/json, text/plain"
    "X-Csrf-Token" = $csrfToken
}

2. 请求体参数不完整 #

Unifi API修改客户端配置时，仅提交use_fixedip和fixed_ip不足以通过验证，需要包含客户端的基本标识信息（如name、mac）。

修复：补充请求体参数：

$FixedIP = @{
    "name" = $Client.name
    "mac" = $Client.mac
    "use_fixedip" = $True
    "fixed_ip" = $Ip
}
$FixedIPJson = $FixedIP | ConvertTo-Json -Depth 10

3. 确认API端点路径正确性 #

UDM Pro的网络API端点可能因固件版本略有差异，若上述修复后仍报错，尝试将PUT端点改为：

$URI = "$controller/proxy/network/api/s/$name/rest/device/$ClientId"

完整修正后的代码 #

$Mac =  "94:9f:3e:b1:27:3c"
[String]$Controller = "https://192.168.1.1"

$cred = Get-Credential
$credentials = @{
    username = $cred.UserName
    password = $cred.GetNetworkCredential().Password
} | ConvertTo-Json

# 忽略自签名证书
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }

# 登录并获取Session
$LoginURI = "$Controller/api/auth/login"
$Session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
$results = Invoke-Restmethod -Uri $LoginURI -Method Post -Body $credentials -ContentType "application/json; charset=utf-8" -WebSession $Session -TimeoutSec 600

# 获取CSRF Token
$csrfToken = $Session.Cookies.GetCookies($Controller)["csrf_token"].Value

# 获取客户端信息
$name = 'default'
$URI = "$controller/proxy/network/api/s/$name/stat/sta"
$request = Invoke-RestMethod -Uri $URI -WebSession $Session
$Client = $request.data | Where-Object { $_.mac -eq $Mac } 
$ClientId = $Client._id
$Ip = $Client.last_ip
 
# 构造完整的固定IP配置请求体
$FixedIP = @{
    "name" = $Client.name
    "mac" = $Client.mac
    "use_fixedip" = $True
    "fixed_ip" = $Ip
}
$FixedIPJson = $FixedIP | ConvertTo-Json -Depth 10

# 发送PUT请求（携带CSRF Token）
$URI = "$controller/proxy/network/api/s/$name/rest/user/$ClientId"
$header = @{
    "accept" = "application/json, text/plain"
    "X-Csrf-Token" = $csrfToken
}
$Fixedresult = Invoke-Restmethod -Uri $URI -Method PUT -Headers $header -Body $FixedIPJson -ContentType "application/json; charset=utf-8" -WebSession $Session
$Fixedresult

额外检查项 #

• 确认登录账号拥有管理员权限（只读权限无法修改客户端配置）
• 检查UDM Pro固件版本，部分新版本API端点或参数有调整

内容的提问来源于stack exchange，提问作者Raderarn