無法通過 XboxLive 400 驗證用戶：錯誤請求

Question

我正在嘗試通過 XboxLive 對用戶進行身份驗證，但我遇到了一些麻煩我正在關注這篇文章，但我無法通過第一步它總是返回400: Bad Request我做了一些挖掘，有些人說把d=在 accessToken 之前，但這沒有幫助。

public void getXboxLiveToken() throws IOException{
        if (this.accessTokenJson == null) getAccessToken();

        Header[] headers = new Header[2];
        headers[0] = applicationJsonContentTypeHeader;
        headers[1] = applicationAcceptJsonHeader;

        HttpPost httpPost = new HttpPost(SIGNIN_XBL_URL);
        httpPost.setHeaders(headers);

        String jsonString = this.gson.toJson(new SignIntoXBLJson(this.accessTokenJson.getAccessToken()));
        StringEntity requestEntity = new StringEntity(jsonString, ContentType.APPLICATION_JSON);
        httpPost.setEntity(requestEntity);
        
        try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
            byte[] responseBytes = response.getEntity().getContent().readAllBytes();
            System.out.println(response.getStatusLine().getStatusCode() + ": " + response.getStatusLine().getReasonPhrase());
            System.out.println(new String(responseBytes));
        }
    }

Json

{
    "Properties": {
        "AuthMethod": "RPS",
        "SiteName": "user.auth.xboxlive.com",
        "RspTicket": "d=<Access Token>"
    },
    "ReplyingParty": "http://auth.xboxlive.com",
    "TokenType": "JWT"
}

Answer 1

我也花了一些時間來弄清楚，但我最終找到了這篇文章： Mojang API 文檔，總結得很好。

該請求需要是帶有 url https://user.auth.xboxlive.com/user/authenticate標頭的'POST'請求：

• Content-Type: application/json
• Accept: application/json

並具有以下主體：

{
    "Properties": {
        "AuthMethod": "RPS",
        "SiteName": "user.auth.xboxlive.com",
        "RpsTicket": "d=ACCESS_TOKEN_HERE" // access token you got from https://login.live.com/oauth20_token.srf
    },
    "RelyingParty": "http://auth.xboxlive.com",
    "TokenType": "JWT"
}

結果應該與此類似：

{
    "IssueInstant": "2022-10-30T01:45:49.8093136Z",
    "NotAfter": "2022-11-13T01:45:49.8093136Z",
    "Token": "TOKEN_HERE",
    "DisplayClaims": {
      "xui": [
         {
            "uhs": "USER_HASH"
         }
      ]
    }
}

我最終實施的解決方案如下所示：

private String getXboxToken(String access_token) throws IOException {
            HttpResponse<JsonNode> xbox_response = Unirest.post("https://user.auth.xboxlive.com/user/authenticate")
        .header("Content-Type", "application/json")
        .header("Accept", "application/json")
        .body("{" +
            "    \"Properties\": {" +
            "        \"AuthMethod\": \"RPS\"," +
            "        \"SiteName\": \"user.auth.xboxlive.com\"," +
            "        \"RpsTicket\": \"d=" + access_token + "\"" + // token retrieved from https://login.live.com/oauth20_token.srf
            "    }," +
            "    \"RelyingParty\": \"http://auth.xboxlive.com\"," +
            "    \"TokenType\": \"JWT\"" +
            "}")
        .asJson();

    // checks for unsuccessful responses
    if (!xbox_response.isSuccess())
        throw new IOException("Couldn't get xbox token :" + xbox_response.getStatusText());

    // just prints the result
    System.out.println(xbox_response.getBody().toPrettyString());

    JSONObject obj = xbox_response.getBody().getObject();
    return (String) obj.get("Token");
}

我正在使用Unirest庫，它大大簡化了代碼