使用Python Requests库登录GameStop.ca遭遇403访问拒绝错误的排查求助

Great question—let’s unpack why you’re hitting this 403 and how to fix it. It’s confusing that Selenium works but raw requests doesn’t, but the key difference lies in how each tool mimics a real user’s browser behavior. Here’s what you’re missing:

1. You’re skipping critical pre-login steps #

Selenium doesn’t just send a POST to the login endpoint—it first loads the login page (and often the homepage before that), which:

• Sets essential session cookies that the server expects to see on subsequent requests
• Generates a CSRF token (Cross-Site Request Forgery protection) that must be included in your login POST

Your current requests code jumps straight to the POST, so the server has no way to verify you’re a legitimate user coming from the login page.

2. Your request headers are incomplete #

While you added a User-Agent, modern anti-bot systems check a full suite of browser-specific headers. Missing headers like Referer, Accept, Sec-Fetch-*, and Origin immediately flag your request as non-browser traffic.

3. Anti-bot fingerprinting (why Selenium works) #

You’re right that Selenium is detectable, but it still mimics a real browser environment: it executes JavaScript, renders the DOM, and carries all the browser-specific fingerprints (like navigator properties) that requests can’t replicate. The server sees Selenium as a real user interacting with the page, whereas requests looks like a script sending raw HTTP calls.

Fixing your requests code #

Here’s a revised version that follows the same flow as a real user:

First, install beautifulsoup4 to parse the login page for the CSRF token:

pip install beautifulsoup4

Then update your code:

import requests
from bs4 import BeautifulSoup

# Full browser-like headers (copied from Chrome's DevTools)
base_headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36',
    'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'Accept-Language': 'en-US,en;q=0.9',
    'Accept-Encoding': 'gzip, deflate, br',
    'Referer': 'https://www.gamestop.ca/',
    'Sec-Fetch-Dest': 'document',
    'Sec-Fetch-Mode': 'navigate',
    'Sec-Fetch-Site': 'same-origin',
    'Sec-Fetch-User': '?1',
    'Upgrade-Insecure-Requests': '1'
}

with requests.session() as s:
    # Step 1: Load the login page to get cookies and CSRF token
    login_page_response = s.get('https://www.gamestop.ca/Account/LogOn', headers=base_headers)
    soup = BeautifulSoup(login_page_response.content, 'html.parser')
    
    # Extract CSRF token (look for hidden input with name "__RequestVerificationToken")
    csrf_token = soup.find('input', {'name': '__RequestVerificationToken'})['value']
    
    # Step 2: Prepare login payload with CSRF token
    payload = {
        'UserName': '*****',
        'Password': '******',
        'RememberMe': 'false',
        '__RequestVerificationToken': csrf_token
    }
    
    # Step 3: Update headers for POST request (add Content-Type and update Referer)
    post_headers = base_headers.copy()
    post_headers['Content-Type'] = 'application/x-www-form-urlencoded'
    post_headers['Referer'] = 'https://www.gamestop.ca/Account/LogOn'
    
    # Step 4: Send login POST
    login_response = s.post('https://www.gamestop.ca/Account/LogOn', headers=post_headers, data=payload)
    
    print(login_response.status_code)
    print(login_response.text)

If it still fails... #

• Double-check the CSRF token name: sometimes it’s named differently (e.g., csrf_token). Use Chrome’s DevTools to inspect the login form’s hidden inputs.
• Gamestop might use additional anti-bot measures like JS-generated cookies or fingerprint checks. If that’s the case, consider using requests-html (which supports JS rendering) or undetected-chromedriver (a modified Selenium that evades detection) instead of raw requests.

内容的提问来源于stack exchange，提问作者whatsupbuttercup