旧Pokeminer项目通过PTC API登录Pokemon Go遇403错误求助

我正在测试一个可生成附近宝可梦地图的旧Pokemon Go开源项目，已修复原有语法问题使其能启动，但通过Pokemon Trainer Club（PTC）登录账号执行地图扫描时持续报错。怀疑是Niantic修改了PTC登录流程或项目老旧导致，特此求助。确认登录信息正确，项目其余部分运行正常。

负责PTC登录的代码（worker.py中的login_ptc函数） #

def login_ptc(username, password):
    logger.info('PTC login for: %s', username)
    head = {'User-Agent': 'Niantic App'}
    session = local_data.api_session
    r = session.get(LOGIN_URL, headers=head)
    try:
        jdata = json.loads(r.content)
    except ValueError:
        logger.warning('login_ptc: could not decode JSON from %s', r.content)
        return None
    # Maximum password length is 15
    # (sign in page enforces this limit, API does not)
    if len(password) > 15:
        logger.debug('Trimming password to 15 characters')
        password = password[:15]

    data = {
        'lt': jdata['lt'],
        'execution': jdata['execution'],
        '_eventId': 'submit',
        'username': username,
        'password': password,
    }
    r1 = session.post(LOGIN_URL, data=data, headers=head)

    ticket = None
    try:
        ticket = re.sub('.*ticket=', '', r1.history[0].headers['Location'])
    except Exception:
        logger.debug('Error: %s', r1.json()['errors'][0])
        return None

    data1 = {
        'client_id': 'mobile-app_pokemon-go',
        'redirect_uri': 'https://www.nianticlabs.com/pokemongo/error',
        'client_secret': PTC_CLIENT_SECRET,
        'grant_type': 'refresh_token',
        'code': ticket,
    }
    r2 = session.post(LOGIN_OAUTH, data=data1)
    access_token = re.sub('&expires.*', '', r2.content)
    access_token = re.sub('.*access_token=', '', access_token)
    return access_token

报错日志（worker.log） #

[2023-12-22 19:12:34,911][MainThread][    INFO][L 661] Starting up!
[2023-12-22 19:12:34,912][MainThread][    INFO][L 607] Worker (re)starting up!
[2023-12-22 19:12:34,914][  worker-0][    INFO][L 289] PTC login for: freq010
[2023-12-22 19:12:34,915][MainThread][    INFO][L 607] Worker (re)starting up!
[2023-12-22 19:12:34,915][  worker-1][    INFO][L 289] PTC login for: freq011
[2023-12-22 19:12:34,915][MainThread][    INFO][L 607] Worker (re)starting up!
[2023-12-22 19:12:34,915][  worker-2][    INFO][L 289] PTC login for: freq012
[2023-12-22 19:12:34,915][MainThread][    INFO][L 607] Worker (re)starting up!
[2023-12-22 19:12:34,916][  worker-3][    INFO][L 289] PTC login for: freq0013

[2023-12-22 19:12:35,075][  worker-3][ WARNING][L 296] login_ptc: could not decode JSON from b'<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">\n<HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">\n<TITLE>ERROR: The request could not be satisfied</TITLE>\n</HEAD><BODY>\n<H1>403 ERROR</H1>\n<H2>The request could not be satisfied.</H2>\n<HR noshade size="1px">\nRequest blocked.\nWe can\'t connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.\n<BR clear="all">\nIf you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.\n<BR clear="all">\n<HR noshade size="1px">\n<PRE>\nGenerated by cloudfront (CloudFront)\nRequest ID: aX5fHDwjp7eNQUAyFKO3hCi11F4xhATUPanZvyZM3MbiKRtHx0k1wA==\n</PRE>\n<ADDRESS>\n</ADDRESS></BODY></HTML>'

[2023-12-22 19:12:35,075][  worker-3][    INFO][L 382] Could not login to PTC - sleeping

问题原因分析 #

• 从报错的403响应来看，请求被CloudFront拦截，大概率是Niantic针对PTC登录接口新增了反爬/验证机制：
  1. 请求头过于简单：原代码仅设置User-Agent: Niantic App，现在Niantic可能要求更贴近真实App的请求头，包括Accept、Accept-Language、Referer等字段，或者需要使用当前有效App版本的UA字符串。
  2. 登录流程已变更：原代码的登录逻辑（获取lt/execution参数→提交表单拿ticket→换token）可能已失效，PTC登录现在可能加入了验证码验证、CSRF token获取方式变化，或者OAuth相关参数（如client_id、grant_type）已被Niantic更新。
  3. 并发请求触发风控：多个worker同时发起登录请求，触发了CloudFront的流量限制，请求特征被识别为非官方客户端。

修复建议 #

1. 完善请求头信息：更新head字典，模拟真实Pokemon Go App的请求头，示例如下：

   head = {
       'User-Agent': 'PokemonGo/0.295.0 (iPhone; iOS 16.6; Scale/2.00)',
       'Accept': '*/*',
       'Accept-Language': 'zh-CN,zh;q=0.9',
       'Referer': 'https://club.pokemon.com/us/pokemon-trainer-club/login',
       'Content-Type': 'application/x-www-form-urlencoded'
   }
   

2. 验证登录端点与参数有效性：通过抓包真实App的登录流程，确认LOGIN_URL、LOGIN_OAUTH是否为当前有效地址，以及client_id、client_secret等OAuth参数是否仍可用。
3. 处理会话与额外验证：确保session能正确保存和传递Cookie；如果登录流程新增了验证码，需集成验证码识别服务（或手动处理，但会增加复杂度）。
4. 降低登录并发度：修改代码让worker依次登录，增加登录间隔，避免触发CloudFront的流量风控。

内容的提问来源于stack exchange，提问作者freq1062