尝试使用请求时，我收到 419 页过期状态代码。 我如何成功登录？

Question

I'm getting a 419 page expired status code when using requests on this site. I gathered the information for the headers and data by monitoring the network tab of the developer console. How can I use the Python requests module to successfully login?

import requests
url = 'https://rates.itgtrans.com/login'

headers = {
    'authority': 'rates.itgtrans.com',
    'cache-control': 'max-age=0',
    'sec-ch-ua': '"Chromium";v="94", "Google Chrome";v="94", ";Not A Brand";v="99"',
    'sec-ch-ua-mobile': '?0',
    'sec-ch-ua-platform': '"Windows"',
    'upgrade-insecure-requests': '1',
    'origin': 'https://rates.itgtrans.com',
    'content-type': 'application/x-www-form-urlencoded',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36',
    'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'sec-fetch-site': 'same-origin',
    'sec-fetch-mode': 'navigate',
    'sec-fetch-user': '?1',
    'sec-fetch-dest': 'document',
    'referer': 'https://rates.itgtrans.com/login',
    'accept-language': 'en-US,en;q=0.9',
    'cookie': 'XSRF-TOKEN=eyJpdiI6IkEzbi9JQkVwbWloZTM1UVdSdVJtK0E9PSIsInZhbHVlIjoiM1pxQVYxajhPcWdlZ1NlYlVMSUlyQzFISVpPNjNrMVB0UmNYMXZGa0crSmYycURoem1vR0FzRUMrNjB2bXFPbCs4U3ZyeGM4ZVNLZ1NjRGVmditUMldNUUNmYmVzeTY2WS85VC93a1c0M0JUMk1Jek00TTNLVnlPb2VVRXpiN0ciLCJtYWMiOiJkNjQyMTMwMGRmZmQ4YTg0ZTNhZDgzODQ5M2NiMmE2ODdlYjRlOTIyMWE5Yjg4YzEyMTBjNTI2ODQxY2YxMzNkIiwidGFnIjoiIn0%3D; draymaster_session=eyJpdiI6Im9vUDZabmlYSTY0a1lSNGdYZzZHT0E9PSIsInZhbHVlIjoiMGVVcSs2T3RheGhMeDNVVFJUQjRmb212TkoySVY5eWFjeVNHT1lGWE9sRHdtR3JTa0REZFhMTzNJeisyTjNOZ1hrQnNscWY0dXBheFFaRFhIdDAvUlFMOFdvTFdaOXBoejcwb2ZDNFNMdDZ6MUFxT2dHU3hlNVkxZmpiTnd2Z0QiLCJtYWMiOiIwN2RmZTc1ZDUzYzViYTgzYWU1MjFjNjIxZjYzMzY3MDE0YjI4MDhkMWMwMTVkYmYxYWM2MzQ0ODM1YzRkNDY1IiwidGFnIjoiIn0%3D'
}

data = {
  '_token': 'o8jJ4tR3PHkuz5TR2kuoHwBAdHd5RczFx2rlul1C',
  'email': '****',
  'password': '****',
  'button': ''
}



with requests.Session() as s:
    cookies = s.cookies
    p = s.post(url='https://rates.itgtrans.com/login', data=data, headers=headers, cookies=cookies)
    print(p)

Answer 1

As for me all problem is that you always use the same _token .

Server for every user should generate new uniq token which is valid only few minutes - all for security reason (so hacker can't get it and use it after longer time)

BTW: went I run your code and get page with status 419 and display p.text then I see HTML with text Page Expired which can confirm that you use expired token.

---

You should always GET this page and search new token in HTML

<input name="_token" type="hidden" value="Xz0pJ0djGVnfaRMuXNDGMdBmZRbc55Ql2Q2CTPit"/>

and use this value in POST

---

I don't have account on this page but using fresh token from <input name="_token"> I get status 200 instead of 419 .

import requests
from bs4 import BeautifulSoup

url = 'https://rates.itgtrans.com/login'

headers = {
    'authority': 'rates.itgtrans.com',
    'cache-control': 'max-age=0',
    'origin': 'https://rates.itgtrans.com',
    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36',
    'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
    'referer': 'https://rates.itgtrans.com/login',
    'accept-language': 'en-US,en;q=0.9',
}

data = {
  '_token': '-empty-',
  'email': '****',
  'password': '****',
  'button': ''
}


with requests.Session() as s:
    
    # --- first GET page ---

    response = s.get(url='https://rates.itgtrans.com/login', headers=headers)
    #print(response.text)

    # --- search fresh token in HTML ---
    
    soup = BeautifulSoup(response.text)
    token = soup.find('input', {'name': "_token"})['value']
    print('token:', token)
    
    # --- run POST with new token ---

    data['_token'] = token
    
    response = s.post(url='https://rates.itgtrans.com/login', data=data, headers=headers)
    #print(response.text)
    print('status_code:', response.status_code)

BTW:

I get 200 even if I don't use headers .

Because code uses Session so I don't have to copy cookies from GET to POST because Session copies them automatically.