使用Python Requests库调用时间API遇401未授权错误排查

我正在开发一个Python脚本，用于持续从Web服务器获取当前时间并打印。但遇到认证问题，返回401状态码。服务器是我校作业用的模拟网站：http://cyber.cs.du.edu/timekeeper/，我已提供必要请求头和Access Token，但仍持续收到401"Unauthorized"错误。

我的代码 #

from datetime import datetime
import time
import requests  # 原代码遗漏该导入，补充后避免运行报错

def get_current_time():
    try:
        time_api_url = "http://cyber.cs.du.edu/timekeeper/api/v1/time"
        headers = {
            'Accept': 'application/json, text/javascript, */*; q=0.01',
            'Authorization': 'Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpcCI6IjE3Mi4xNy4wLjEiLCJybmQiOiIxMWEzN2Q1YTQ3ZTQxY2ViNzMwZWEyNDg5N2MzOWMwZTUwM2QzNDU1NGQ5MjFjNmE0NGY2NGJlMDI5OTkxYTU5IiwiYWdlbnQiOiJNb3ppbGxhLzUuMCAoTWFjaW50b3NoOyBJbnRlbCBNYWMgT1MgWCAxMF8xNV83KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE5LjAuMC4wIFNhZmFyaS81MzcuMzYiLCJleHAiOjE2OTk1NTM4NTJ9.fFIpbEmAhotro4MgL0GTSbYrtl--t92MTFKnNX-tnfw',
            'Connection': 'keep-alive',
            'Cookie': '_cap=344691521684862355; _fbp=fb.1.1684862355417.17791420; _attrb=%22293b6266-57cb-4269-93ef-a6308b74f593%22; _scid=8509b8d8-90ea-4e40-840d-6f19637fbe27; _ga_S2V8B3QG10=GS1.2.1693412411.17.0.1693412411.0.0.0; _gcl_au=1.1.1900453194.1694548891; _ga_EQYTG2FRZB=GS1.1.1694643835.4.1.1694643921.0.0.0; _ga_3R9779E9CE=GS1.1.1697141496.2.1.1697141511.0.0.0; _ga_YD6NSK449L=GS1.1.1698702601.3.0.1698702602.59.0.0; _ga_G3QL5ZJ7V2=GS1.1.1698706614.2.1.1698706721.60.0.0; cebs=1; _gid=GA1.2.7375447.1699384534; _ga_KDCJP7WQR2=GS1.2.1699384534.32.1.1699384541.0.0.0; _sctr=1%7C1699340400000; cebsp_=3; _scid_r=8509b8d8-90ea-4e40-840d-6f19637fbe27; _ce.s=v~cdafb05ef8918fcf3bc3bb022cd2ae51233ea0de~lcw~1699393884317~vpv~3~v11.cs~348336~v11.s~690beb20-7db7-11ee-8ffb-e3470a664e62~v11.sla~1699393884364~gtrk.la~loov8lm7~v11.send~1699393884316~lcw~1699393884366; _ga_7KPJG812Y3=GS1.1.1699394129.1.1.1699394621.0.0.0; _ga=GA1.2.1823087093.1684861047; _ga_CMGRJVENZ2=GS1.1.1699484166.33.0.1699484166.60.0.0; _ga_0F4BY0DEFX=GS1.1.1699484166.5.0.1699484166.0.0.0; _ga_RPN0H7RH0P=GS1.2.1699484369.203.1.1699484382.0.0.0; bt=1699553552.3100853; _acdk=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0cyI6MTY5OTU1MzU1MiwiZXhwIjoxNjk5NTUzNTYyLCJ0b2tlbiI6ImV5SmhiR2NpT2lKSVV6STFOaUlzSW5SNWNDSTZJa3BYVkNKOS5leUpwY0NJNklqRTNNaTR4Tnk0d0xqRWlMQ0p5Ym1RaU9pSXhNV0V6TjJRMVlUUTNaVFF4WTJWaU56TXdaV0V5TkRnNU4yTXpPV013WlRVd00yUXpORFUxTkdRNU1qRmpObUUwTkdZMk5HSmxNREk1T1RreFlUVTVJaXdpWVdkbGJuUWlPaUpOYjNwcGJHeGhMelV1TUNBb1RXRmphVzUwYjNOb095QkpiblJsYkNCTllXTWdUMU1nV0NBeE1GOHhOVjgzS1NCQmNIQnNaVmRsWWt0cGRDODFNemN1TXpZZ0tFdElWRTFNTENCc2FXdGxJRWRsWTJ0dktTQkRhSEp2YldVdk1URTVMakF1TUM0d0lGTmhabUZ5YVM4MU16Y3VNellpTENKbGVIQWlPakUyT1RrMU5UTTROVEo5LmZGSXBiRW1BaG90cm80TWdMMEdUU2JZcnRsLS10OTJNVEZLbk5YLXRuZncifQ.lkFT0blGLG50DJy_jfQUFuUdHDhnId1WBBk68vIQbeM',
            'Host': 'cyber.cs.du.edu',
            'Referer': 'http://cyber.cs.du.edu/timekeeper/',
            'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36',
            'X-Requested-With': 'XMLHttpRequest',
            'X-Timekeeper-Channel': 'Web'
        }

        response = requests.get(time_api_url, headers=headers)

        print(response)

        if response.status_code == 200:
            try:
                current_time = response.json().get('current_time')
                formatted_time = datetime.utcfromtimestamp(current_time).strftime('%Y-%m-%d %H:%M:%S')
                print(formatted_time)
            except ValueError:
                print("Invalid JSON response")

        else:
            print(f"Error: {response.text}")

    except Exception as e:
        print(f"An error occurred: {e}")

if __name__ == "__main__":
    try:
        while True:
            get_current_time()
            time.sleep(1)  # Adjust the sleep interval as needed
    except KeyboardInterrupt:
        print("Script stopped.")

可能的原因排查 #

• 令牌过期：你的Access Token中exp字段值为1699553852，对应UTC时间2023-11-09 15:37:32，若当前时间已超过该点，令牌会直接失效，返回401。可通过JWT解码工具验证过期时间。
• Cookie与Authorization头冲突：你同时发送了Cookie和Authorization头，部分服务器会优先使用Cookie中的认证信息（比如Cookie里的_acdk字段也是一个令牌），若Cookie内令牌过期或无效，会覆盖Authorization头的认证逻辑，导致401。建议先移除Cookie字段，仅保留Authorization头测试。
• IP/User-Agent校验不匹配：令牌中包含ip（172.17.0.1）和agent字段，服务器可能校验请求的真实IP、User-Agent是否与令牌记录一致。若脚本运行环境IP不符，或User-Agent存在细微差异，都会触发401。
• 请求头遗漏或顺序问题：部分服务器会校验请求头的顺序或隐含字段（如Accept-Encoding、Cache-Control），可通过浏览器F12抓包对比真实请求头，补充遗漏字段后再测试。
• 端点或请求方式错误：确认API端点http://cyber.cs.du.edu/timekeeper/api/v1/time是否正确，是否需要使用POST而非GET请求。可查看浏览器Network面板中的实际请求方法和端点。

内容的提问来源于stack exchange，提问作者Amber Sonlit