登录Zalando时遭遇<Response [403]>错误，求解决方案

问题描述 #

对接Zalando项目时调用登录接口返回<Response [403]>错误，当前使用的登录代码如下：

def login():

    headers = {
        'authority': 'accounts.zalando.com',
        'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
        'accept-language': 'fr-FR,fr;q=0.9',
        'referer': 'https://accounts.zalando.com/authenticate?sales_channel=xxxxxxxxxxxxxxxx&passwordMeterFT=true',
        'sec-ch-ua': '"Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"',
        'sec-ch-ua-mobile': '?0',
        'sec-ch-ua-platform': '"Windows"',
        'sec-fetch-dest': 'document',
        'sec-fetch-mode': 'navigate',
        'sec-fetch-site': 'same-origin',
        'sec-fetch-user': '?1',
        'upgrade-insecure-requests': '1',
        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36',
    }

    url = 'https://zalando.com/api'

    r = requests.get(url, headers=headers)
    #print(r.cookies.get_dict())
    #print(r.headers)


    headers = {
        'authority': 'accounts.zalando.com',
        'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
        'accept-language': 'fr-FR,fr;q=0.9',
        'cookie': r.headers['Set-Cookie'],
        'referer': 'https://accounts.zalando.com/authenticate?sales_channel=XXXXXXXXXXXXXXXX&passwordMeterFT=true',
        'sec-ch-ua': '"Not_A Brand";v="99", "Google Chrome";v="109", "Chromium";v="109"',
        'sec-ch-ua-mobile': '?0',
        'sec-ch-ua-platform': '"Windows"',
        'sec-fetch-dest': 'document',
        'sec-fetch-mode': 'navigate',
        'sec-fetch-site': 'same-origin',
        'sec-fetch-user': '?1',
        'upgrade-insecure-requests': '1',
        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36',
        'x-csrf-token': r.cookies.get_dict()['Zalando-Client-Id'],
        'x-flow-id': r.headers['X-Zalando-Child-Request-Id']
    }

    params = {
        'email': 'xxx',
        'secret': 'xxxXXXXXXXXX',
    }

    response = requests.post('https://accounts.zalando.com/api/login', json=params, headers=headers)
    print(response.content)
    print(response.json())
    print(response.cookies.get_dict())
    print(response.headers)
    


login()

修复方法 #

1. 修正初始请求URL #

首次请求的https://zalando.com/api并非Zalando认证的前置接口，应改为访问登录认证页面：

url = 'https://accounts.zalando.com/authenticate?sales_channel=xxxxxxxxxxxxxxxx&passwordMeterFT=true'

2. 使用Session管理Cookie #

手动提取Set-Cookie并设置会导致Cookie格式错误，用requests.Session()自动维持会话：

def login():
    session = requests.Session()
    headers = {
        'authority': 'accounts.zalando.com',
        'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
        'accept-language': 'fr-FR,fr;q=0.9',
        'referer': 'https://accounts.zalando.com/authenticate?sales_channel=xxxxxxxxxxxxxxxx&passwordMeterFT=true',
        'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36',
    }
    # 用session发送首次请求，自动保存Cookie
    r = session.get(url, headers=headers)

3. 正确获取CSRF Token #

x-csrf-token不应使用Zalando-Client-Id，需从首次请求的Cookie中提取正确的CSRF字段（通常为csrf-token）：

csrf_token = r.cookies.get('csrf-token')
# 若Cookie中没有，需解析响应HTML页面提取隐藏域中的CSRF值

4. 调整POST请求头 #

登录接口为JSON类型，需移除针对HTML页面的头部字段，添加Content-Type：

post_headers = {
    'authority': 'accounts.zalando.com',
    'accept': 'application/json',
    'accept-language': 'fr-FR,fr;q=0.9',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36',
    'content-type': 'application/json',
    'x-csrf-token': csrf_token,
}

5. 优先使用官方API #

模拟前端登录易触发反爬机制，建议采用Zalando官方提供的OAuth2等认证方案，通过合法的API密钥和流程完成对接，从根源避免403拦截。

内容的提问来源于stack exchange，提问作者antho msc