如何使用Selenium WebDriver获取浏览器中登录后的ID Token及Bearer Access Token

Hey there! I’ve helped a bunch of folks with exactly these Selenium token-grabbing questions, so let’s dive into the practical steps you need:

ID Tokens are almost always stored in one of three places: localStorage, sessionStorage, or browser cookies. Here’s how to yank them out with Selenium:

Step-by-Step Approach #

• First, make sure the user is logged in: either automate the login flow with Selenium, or pause execution to let the user log in manually (great for testing).
• Use Selenium to execute JavaScript that pulls the token from the correct storage location.

Code Example (Python) #

from selenium import webdriver

# Initialize driver (Chrome example)
driver = webdriver.Chrome()
driver.get("https://your-target-website.com/login")

# Optional: Automate login here (fill username/password, click submit)
# OR wait for manual login
input("Press Enter once you've logged in...")

# Check localStorage first (most common for SPA apps)
id_token = driver.execute_script("return localStorage.getItem('id_token');")
if id_token:
    print(f"ID Token from localStorage: {id_token}")
else:
    # Fallback to sessionStorage
    id_token = driver.execute_script("return sessionStorage.getItem('id_token');")
    if id_token:
        print(f"ID Token from sessionStorage: {id_token}")
    else:
        # Check cookies
        for cookie in driver.get_cookies():
            if cookie["name"] == "id_token":
                print(f"ID Token from Cookie: {cookie['value']}")
                break

Pro Tip #

Before writing code, open your browser’s DevTools (F12) → Application tab to check exactly where the token is stored and what key it uses (some sites call it auth_id_token or user_id_token instead of plain id_token).

Bearer Access Tokens follow the same storage patterns as ID Tokens, but sometimes you might need to grab them from network responses too. Let’s cover both scenarios:

Scenario 1: Token Stored in Browser Storage/Cookies #

Same approach as the ID Token—just target the right key (usually access_token):

# Grab from localStorage
access_token = driver.execute_script("return localStorage.getItem('access_token');")
if access_token:
    print(f"Bearer Token: Bearer {access_token}")
else:
    # Check sessionStorage
    access_token = driver.execute_script("return sessionStorage.getItem('access_token');")
    if access_token:
        print(f"Bearer Token: Bearer {access_token}")
    else:
        # Check cookies
        for cookie in driver.get_cookies():
            if cookie["name"] == "access_token":
                print(f"Bearer Token: Bearer {cookie['value']}")
                break

Scenario 2: Token Returned in Network Response Headers #

If the token is sent back in a response header (e.g., after login), you can use Selenium’s DevTools API to intercept network traffic:

from selenium.webdriver.common.devtools.v117 import network

# Enable network monitoring
driver.execute_cdp_cmd('Network.enable', {})

# Define a callback to catch responses with the token
def capture_token(response):
    headers = response["response"]["headers"]
    if "access-token" in headers:  # Note: header keys are often lowercase here
        token = headers["access-token"]
        print(f"Bearer Token from Response: Bearer {token}")

# Attach the callback to the response received event
driver.add_cdp_listener('Network.responseReceived', capture_token)

# Trigger the request that returns the token (e.g., refresh the page)
driver.refresh()

# Disable network monitoring when done
driver.execute_cdp_cmd('Network.disable', {})

Important Notes #

• Respect Site Policies: Always make sure you’re allowed to scrape or access these tokens—violating a site’s terms of service can get you blocked or in legal trouble.
• Anti-Detection: Many sites flag vanilla Selenium. If you run into issues, try using undetected-chromedriver instead of the standard Chrome driver to avoid being blocked.
• Key Variations: Double-check the exact key name in DevTools—sites often use custom names like bearer_token or api_access_token.

内容的提问来源于stack exchange，提问作者Niraj