Cannot authenticate anymore (HTTP 403 Forbidden)

Question

Cannot authenticate anymore (HTTP 403 Forbidden)

Closed this issue 2 years ago · 29 comments

Hi,

I cannot authenticate anymore.
Hi,

The following error appends during the client authentication:

Using version 22.9.10
Traceback (most recent call last):
  File "tgtg-alerts.py", line 42, in <module>
    main()
  File "tgtg-alerts.py", line 8, in main
    token = client.get_credentials()
  File "/usr/local/lib/python3.10/dist-packages/tgtg/__init__.py", line 84, in get_credentials
    self.login()
  File "/usr/local/lib/python3.10/dist-packages/tgtg/__init__.py", line 165, in login
    raise TgtgLoginError(response.status_code, response.content)
tgtg.exceptions.TgtgLoginError: (403, b'<html><head><title>apptoogoodtogo.com</title><style>#cmsg{animation: A 1.5s;}@keyframes A{0%{opacity:0;}99%{opacity:0;}100%{opacity:1;}}</style></head><body style="margin:0"><p id="cmsg">Please enable JS and disable any ad blocker</p><script data-cfasync="false">var dd={\'cid\':\'AHrlqAAAAAMA93PIG3AH-zAAVEvhNA==\',\'hsh\':\'1D42C2CA6131C526E09F294FE96F94\',\'t\':\'fe\',\'r\':\'b\',\'s\':35587,\'e\':\'0d8230bb1520a6625b31cd5358fadcfecf8c6a16d692d82b7718b705a2dd3945\',\'host\':\'geo.captcha-delivery.com\'}</script><script data-cfasync="false" src="https://ct.captcha-delivery.com/c.js"></script></body></html>\n')

Answer 1 · 2022-10-14T10:16:52.000Z

Yess same issue, I think their updated anti bot things :(

Answer 2 · 2022-10-14T15:16:19.000Z

For me it works when I run my script locally but when I run it from an AWS Lambda function, it works sometimes and sometimes I got the same error than you ..

Answer 3 · 2022-10-15T17:26:45.000Z

Same issue here

Answer 4 · 2022-10-18T05:10:56.000Z

I managed to get the code to work by:

turning off all bots for a long time (1 day);
renewing the cookie;
launching on a single account

It seems to be working again... Will see if it keeps working...

Answer 5 · 2022-10-25T16:47:43.000Z

@gaiz-k about what cookie are you talking about? Do you mean tokens?

Answer 6 · 2022-11-06T15:55:32.000Z

EDIT: Problem solved! The Problem was my VPN Network which was activated. After deactivated the Script will be works fine!

Running on a Raspberry Pi 2 with Ubuntu Server 20.04

I got the same error today. Same with a new Account, new IP and new system on machine.

python3 login.py Using version 22.10.10 Traceback (most recent call last): File "login.py", line 4, in <module> credentials = client.get_credentials() File "/usr/local/lib/python3.8/dist-packages/tgtg/__init__.py", line 84, in get_credentials self.login() File "/usr/local/lib/python3.8/dist-packages/tgtg/__init__.py", line 165, in login raise TgtgLoginError(response.status_code, response.content) tgtg.exceptions.TgtgLoginError: (403, b'<html><head><title>apptoogoodtogo.com</title><style>#cmsg{animation: A 1.5s;}@keyframes A{0%{opacity:0;}99%{opacity:0;}100%{opacity:1;}}</style></head><body style="margin:0"><p id="cmsg">Please enable JS and disable any ad blocker</p><script data-cfasync="false">var dd={\'cid\':\'AHrlqAAAAAMA0bn-yDiW-J4Aa70eVg==\',\'hsh\':\'1D42C2CA6131C526E09F294FE96F94\',\'t\':\'fe\',\'r\':\'b\',\'s\':35587,\'e\':\'ee238cca215333eeb2a1da41651ba55316b0d19c86928c2b8188d4e9ec8cb6d3\',\'host\':\'geo.captcha-delivery.com\'}</script><script data-cfasync="false" src="https://ct.captcha-delivery.com/c.js"></script></body></html>\n')

Answer 7 · 2022-11-09T11:51:46.000Z

The same for me. Error on login stage

Answer 8 · 2022-11-10T14:21:32.000Z

Looks like having a valid datadome cookie is now mandatory

Answer 9 · 2022-11-14T22:25:03.000Z

Looks like having a valid datadome cookie is now mandatory

Is there any bypass for that?

Answer 10 · 2022-11-15T11:35:52.000Z

a valid datadome cookie is now mandatory

I don't think its mandatory. I suppose its only necessary when you're ip/ip range is banned/low score by datadome. Try using mobile provider ip.

Answer 11 · 2022-11-17T20:10:37.000Z

I don't think its mandatory. I suppose its only necessary when you're ip/ip range is banned/low score by datadome. Try using mobile provider ip.

Thank you for the tip, I'll have a try from a different location + user country configured

Answer 12 · 2022-11-18T09:40:59.000Z

I don't think its mandatory. I suppose its only necessary when you're ip/ip range is banned/low score by datadome. Try using mobile provider ip.

Thank you for the tip, I'll have a try from a different location + user country configured

For me the mobile ip resolves the case. What do you mean by "user country configured"?

Answer 13 · 2022-11-18T10:20:33.000Z

in case it helps, I experienced the same, and it seems that they blacklist your public IP
In order to avoid it, I think that the limit for bot detection is around 10 seconds. If you query every 15 seconds it should not blacklist you

Answer 14 · 2022-11-18T19:45:25.000Z

It depends on the ip. I noticed residential ip are banned even when sleep time is longer. Mobile ips tend to work with shorter sleep time. In my case 20s. With 15s I get 403 from time to time. I didn'try anything in between yet

Answer 15 · 2022-11-21T22:17:28.000Z

Yesterday i got a notification about a available magicbag from my favorites directly over TooGoodToGo App! But this Case was only one time and only fir one of my favs. Later in the day are still other magicbags available, but no directly notification over toogoodtogo app.

Answer 16 · 2022-11-22T03:16:27.000Z

From what I've understood, stores can press a button in their UI to notify the people that has their items as favorite

Answer 17 · 2022-11-28T11:17:54.000Z

has anyone been able to fix/quick fix the issue? I had the time sleep to 1 minute, until it stopped working, Thanks!

Answer 18 · 2022-11-30T14:01:59.000Z

has anyone been able to fix/quick fix the issue? I had the time sleep to 1 minute, until it stopped working, Thanks!

just new ip

Answer 19 · 2022-12-12T19:32:19.000Z

I'm getting a 403 even though I refreshed my IP and waited a few days

Answer 20 · 2022-12-13T12:59:15.000Z

try new ip along with new account. Is the IP shared with other people or its just for yourself?

Answer 21 · 2022-12-13T16:38:29.000Z

I tried a VPN coupled with a proxy and it still didn't work, they must have banned the MAC address, I happened to run my program twice and it made 2 calls every seconds and probably got me banned even though 2/seconds is pretty low.
I booted up an EC2 and it's fine there with 1 call/minute

Answer 22 · 2023-01-10T17:11:47.000Z

I finally find something that works. I use rotating mobile proxies that change IP adress every 5 minutes. Since I use that, I do not have problems.

Answer 23 · 2023-01-10T21:18:18.000Z

where to get them? wt., 10 sty 2023 o 18:12 leolehenaff ***@***.***> napisał(a):

…

I finally find something that works. I use rotating mobile proxies that change IP adress every 5 minutes. Since I use that, I do not have problems. — Reply to this email directly, view it on GitHub <#193 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3HYDZCN7TKEJWFVIK3AWNTWRWJ57ANCNFSM6AAAAAARFA2P3A> . You are receiving this because you commented.Message ID: ***@***.***>

Answer 24 · 2023-01-19T08:42:18.000Z

They are a lot of internet websites that propose some rotating mobile proxies, just have a look at them on google and chose the one that fits your needs. However they are not free.

Answer 25 · 2023-01-22T21:28:14.000Z

Hi,

I cannot authenticate anymore. Hi,

The following error appends during the client authentication:

Using version 22.9.10
Traceback (most recent call last):
  File "tgtg-alerts.py", line 42, in <module>
    main()
  File "tgtg-alerts.py", line 8, in main
    token = client.get_credentials()
  File "/usr/local/lib/python3.10/dist-packages/tgtg/__init__.py", line 84, in get_credentials
    self.login()
  File "/usr/local/lib/python3.10/dist-packages/tgtg/__init__.py", line 165, in login
    raise TgtgLoginError(response.status_code, response.content)
tgtg.exceptions.TgtgLoginError: (403, b'<html><head><title>apptoogoodtogo.com</title><style>#cmsg{animation: A 1.5s;}@keyframes A{0%{opacity:0;}99%{opacity:0;}100%{opacity:1;}}</style></head><body style="margin:0"><p id="cmsg">Please enable JS and disable any ad blocker</p><script data-cfasync="false">var dd={\'cid\':\'AHrlqAAAAAMA93PIG3AH-zAAVEvhNA==\',\'hsh\':\'1D42C2CA6131C526E09F294FE96F94\',\'t\':\'fe\',\'r\':\'b\',\'s\':35587,\'e\':\'0d8230bb1520a6625b31cd5358fadcfecf8c6a16d692d82b7718b705a2dd3945\',\'host\':\'geo.captcha-delivery.com\'}</script><script data-cfasync="false" src="https://ct.captcha-delivery.com/c.js"></script></body></html>\n')

Make sure your 'access_token' is empty when you are logging in.
When this variable is set, you will send this to the API and will receive an error.

Answer 26 · 2023-01-22T21:35:20.000Z

a valid datadome cookie is now mandatory

I don't think its mandatory. I suppose its only necessary when you're ip/ip range is banned/low score by datadome. Try using mobile provider ip.

For some weird reason it is mandatory for me.
The program was running on another location (different IP) until the 403 erro, when I ran it on my pc, I had the same issue.

By adding the cookie to the header, everything works again.

#205 (comment)

Answer 27 · 2023-01-27T13:13:03.000Z

New version 0.14.0 have been published on pypi. This one should fix issue encountered here

Answer 28 · 2023-01-28T23:56:41.000Z

Great work everyone!
I can confirm it's indeed working as intended (Chouffy/home_assistant_tgtg#48).
This issue can be closed IMHO.

Answer 29 · 2023-01-29T14:58:36.000Z

I confirm it work now ! Thank you !