3 ms·

Can anyone elaborate on "secret undocumented APIs where you need to copy your cookies out of the browser to get access to them"? That sounds fascinating

mynameismon 5y ago
So as a part of my daily activities, I have to use a portal that has an absolutely terrible interface, with text reflowing on every click, parsing and loading a 1 MB JSON file from an internal API taking about 5 minutes (of course, its a janky SPA with developers filling it with useless JS). Irritated, one day, I fired up dev tools, opened the Networks tab and copied the relevant API request that was being fired as a bash command, converted it to Python [1]. After that, I merely parsed the JSON, dumped it into a HTML file, and saved it on my hard drive so I wouldn't need to login to the portal again. [1]: https://curlconverter.com/ https://curlconverter.com/
gen220 5y ago
If you look at the `network` tab in developer tools, you'll see every http request made by your browser, and the headers that are sent along with the request. e.g. when you hit the `reply` button in HN, it'll make some HTTP request, with a cookie in the header that identifies your user session. You can right-click on the request and click "copy request as curl", and then paste it into a terminal to duplicate the request locally. Fore example, Stripe has some API endpoints that are only available to logged-in dashboard.stripe.com users. They are not documented in the public API spec, and they have more powers than the public API. If you do the actions in the dashboard and record the requests, you can use those undocumented APIs: all you need it a session token! This leads down an unstable path, where you write a browser-emulating script to login to $service, scrape the cookie, and then use the cookie to make requests against the $service's undocumented API. Not a good idea to build companies on this logic, but it's fine and fun for personal projects.

mynameismon 5y ago

So as a part of my daily activities, I have to use a portal that has an absolutely terrible interface, with text reflowing on every click, parsing and loading a 1 MB JSON file from an internal API taking about 5 minutes (of course, its a janky SPA with developers filling it with useless JS). Irritated, one day, I fired up dev tools, opened the Networks tab and copied the relevant API request that was being fired as a bash command, converted it to Python [1]. After that, I merely parsed the JSON, dumped it into a HTML file, and saved it on my hard drive so I wouldn't need to login to the portal again. [1]: https://curlconverter.com/ https://curlconverter.com/

gen220 5y ago

If you look at the `network` tab in developer tools, you'll see every http request made by your browser, and the headers that are sent along with the request. e.g. when you hit the `reply` button in HN, it'll make some HTTP request, with a cookie in the header that identifies your user session. You can right-click on the request and click "copy request as curl", and then paste it into a terminal to duplicate the request locally. Fore example, Stripe has some API endpoints that are only available to logged-in dashboard.stripe.com users. They are not documented in the public API spec, and they have more powers than the public API. If you do the actions in the dashboard and record the requests, you can use those undocumented APIs: all you need it a session token! This leads down an unstable path, where you write a browser-emulating script to login to $service, scrape the cookie, and then use the cookie to make requests against the $service's undocumented API. Not a good idea to build companies on this logic, but it's fine and fun for personal projects.