微博登录和session恢复过程

绝地灬酷狼 2022-02-15 18:14 207阅读 0赞

### 微博登录和session恢复过程 ###

*  登录
 *   *  预登录
     *  获取验证码
     *  登录
     *   *  密码密文sp计算
         *  登录请求
     *  跨域广播登录
     *   *  解决cookie设置不上的问题
     *  跨域广播之后
 *  恢复session

完整源码参考我的[pixiv-to-weibo][]项目，只实现了核心部分，没做容错处理

# 登录 #

## 预登录 ##

这一步是为了获取加密公钥和nonce，因为以前新浪没用HTTPS，必须手动加密。其中用户名编码su算法为`BASE64(URI编码(用户名))`

async def _pre_login(self, su):
            async with self._session.get('https://login.sina.com.cn/sso/prelogin.php', params={ 
                'entry':    'weibo',
                'callback': 'sinaSSOController.preloginCallBack',
                'su':       su,
                'rsakt':    'mod',
                'checkpin': '1',
                'client':   'ssologin.js(v1.4.18)'
            }) as r:
                return self.__get_jsonp_response(await r.text())

返回方式是JSONP，有用的是这几个字段：用来加密的公钥`pubkey`，防止回放攻击的`nonce`和`servertime`，之后请求要用的`rsakv`，是否需要验证码`showpin`，验证码请求要用的`pcid`

## 获取验证码 ##

如果预登录返回的数据中`showpin`为1则需要验证码。获取验证码的请求如下，返回的是验证码图片数据

async def _input_verif_code(self, pcid):
            async with self._session.get('https://login.sina.com.cn/cgi/pin.php', params={ 
                'r': random.randint(0, 100000000),
                's': '0',
                'p': pcid
            }) as r:
                img_data = await r.read()
            self._show_image(img_data)
            return input('输入验证码：')

## 登录 ##

### 密码密文sp计算 ###

sp算法为：`转十六进制文本(RSA(servertime + '\t' + nonce + '\n' + 密码))`，其中RSA公钥在预登录时返回

@staticmethod
        def _get_secret_password(password, servertime, nonce, pubkey):
            key = rsa.PublicKey(int(pubkey, 16), 65537)
            res = rsa.encrypt(f'{servertime}\t{nonce}\n{password}'.encode(), key)
            res = binascii.b2a_hex(res)
            return res.decode()

### 登录请求 ###

![登录请求][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmZ3J5dWpr_size_16_color_FFFFFF_t_70]  
登录请求如下，这个请求完成后就可以发微博了。很多微博登录的源码都只做到这一步，但是24小时后session会失效，少了后面的步骤则不能恢复session

async def login(self, username, password):
            su = base64.b64encode(quote_plus(username).encode()).decode()
            data = await self._pre_login(su)
    
            async with self._session.post('https://login.sina.com.cn/sso/login.php', params={ 
                'client': 'ssologin.js(v1.4.19)',
            }, data={ 
                'entry':       'weibo',
                'gateway':     '1',
                'from':        '',
                'savestate':   '7',
                'qrcode_flag': 'false',
                'useticket':   '1',
                'pagerefer':   'https://login.sina.com.cn/crossdomain2.php?action=logout&'
                               'r=https%3A%2F%2Fpassport.weibo.com%2Fwbsso%2Flogout%3Fr%3'
                               'Dhttps%253A%252F%252Fweibo.com%26returntype%3D1',
                'vsnf':        '1',
                'su':          su,
                'service':     'miniblog',
                'servertime':  data['servertime'],
                'nonce':       data['nonce'],
                'pwencode':    'rsa2',
                'rsakv':       data['rsakv'],
                'sp':          self._get_secret_password(password, data['servertime'],
                                                         data['nonce'], data['pubkey']),
                'sr':          '1366*768',
                'encoding':    'UTF-8',
                'prelt':       '233',
                'url':         'https://weibo.com/ajaxlogin.php?framelogin=1&callback='
                               'parent.sinaSSOController.feedBackUrlCallBack',
                'returntype':  'META',
                'door':        '' if data['showpin'] == 0
                               else await self._input_verif_code(data['pcid'])
            }) as r:
                return await self.__handle_login_page(str(r.url), await r.text())

返回内容为一个网页，其中有脚本跳转到下一个地址

<html>
    		<head>
    		<title>新浪通行证</title>
    		<meta http-equiv="refresh" content="0; url='https://login.sina.com.cn/crossdomain2.php?action=login&entry=weibo&......'"/>
    		<meta http-equiv="Content-Type" content="text/html; charset=GBK" />
    		</head>
    		<body bgcolor="#ffffff" text="#000000" link="#0000cc" vlink="#551a8b" alink="#ff0000">
    		<script type="text/javascript" language="javascript"> location.replace("https://login.sina.com.cn/crossdomain2.php?action=login&entry=weibo&......"); </script>
    		</body>
    		</html>

微博登录中跳转的网址是不确定的，有时候是`https://login.sina.com.cn/crossdomain2.php`，有时候是`https://passport.weibo.com/visitor/visitor`，整个流程不能写死，所以我专门写了一个函数来处理这些跳转

async def __handle_login_page(self, url, res):
            while True:
                # 登录页
                if url.startswith('https://login.sina.com.cn/sso/login.php'):
                    next_url = self.__get_next_url(res)
    
                # ...
    
                # 登录完毕
                elif url.startswith('https://weibo.com'):
                    return '/home' in url
    
                # 未知的地址
                else:
                    print('未知的地址：' + url)
                    print(res)
                    return False
    
                async with self._session.get(next_url, headers={ 
                    'Referer': url  # 访问visitor?a=restore必须带referer
                }) as r:
                    url = str(r.url)
                    res = await r.text()

## 跨域广播登录 ##

这是上一步跳转到的`crossdomain2.php`干的事，就是你打开微博偶尔会看到的"Signing in …"的页面。[旧版sso登录脚本][sso]没有混淆并且有中文注释，有兴趣的自己看吧。`arrURL`是要发送请求的URL列表，请求完成后调用`location.replace`跳转

广播URL中要关注的是`passport.weibo.com`这个域名，会设置一些恢复session用的cookie，Python中有些坑会导致这些cookie设置不上，这个后面再说

<html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=GBK" />
    <title>Sina Passport</title>
    
    
    <script charset="utf-8" src="https://i.sso.sina.com.cn/js/ssologin.js"></script>
    </head>
    <body>
    Signing in ...
    <script> try{ sinaSSOController.setCrossDomainUrlList({ "retcode":0,"arrURL":["......"]});} catch(e){ var msg = e.message; var img = new Image(); var type = 1; img.src = 'https://login.sina.com.cn/sso/debuglog?msg=' + msg +'&type=' + type; }try{ sinaSSOController.crossDomainAction('login',function(){ location.replace('https://passport.weibo.com/wbsso/login?......');});} catch(e){ var msg = e.message; var img = new Image(); var type = 2; img.src = 'https://login.sina.com.cn/sso/debuglog?msg=' + msg +'&type=' + type; } </script>
    </body>
    </html>

`__handle_login_page`中对这个页面的处理如下

# 跨域登录广播
                elif url.startswith('https://login.sina.com.cn/crossdomain2.php'):
                    async def cross_domain_callback(url_, i):
                        async with self._session.get(url_, params={ 
                            'callback': 'sinaSSOController.doCrossDomainCallBack',
                            'scriptId': 'ssoscript' + str(i),
                            'client': 'ssologin.js(v1.4.2)'
                        }) as r_:
                            await r_.read()
    
                    url_list = re.search(r'setCrossDomainUrlList$(.*?)$;', res)[1]
                    url_list = json.loads(url_list)['arrURL']
                    await asyncio.gather(*(
                        cross_domain_callback(url, i) for i, url in enumerate(url_list)
                    ))
    
                    next_url = self.__get_next_url(res)

### 解决cookie设置不上的问题 ###

这个是因为新浪返回的cookie中expire的星期几用的是全称，而Python标准库中的正则假设它用的是3个字符的简称：`\w{3},\s[\w\d\s-]{9,11}\s[\d:]{8}\sGMT`

>>> import http.cookies
    >>> cookie = http.cookies.SimpleCookie()
    >>> cookie.load('SRF=155......; expires=Sunday, 15-Apr-2029 13:18:56 GMT; path=/; domain=.passport.weibo.com')
    >>> cookie
    <SimpleCookie: >
    >>> cookie.load('SRF=155......; expires=Sun, 15-Apr-2029 13:18:56 GMT; path=/; domain=.passport.weibo.com')
    >>> cookie
    <SimpleCookie: SRF='155......'>

我的解决方法是在脚本开头用黑科技把这个正则改了，不过不保证可移植性，如果不能用就自己想办法吧

import http.cookies
    http.cookies.BaseCookie._BaseCookie__parse_string.__defaults__ = (
        re.compile(r""" \s* # Optional whitespace at start of cookie (?P<key> # Start of group 'key' [""" + http.cookies._LegalKeyChars + r"""]+? # Any word of at least one letter ) # End of group 'key' ( # Optional group: there may not be a value. \s*=\s* # Equal Sign (?P<val> # Start of group 'val' "(?:[^\\"]|\\.)*" # Any doublequoted string | # or \w{3,},\s[\w\d\s-]{9,11}\s[\d:]{8}\sGMT # Special case for "expires" attr | # or [""" + http.cookies._LegalValueChars + r"""]* # Any word or empty string ) # End of group 'val' )? # End of optional value group \s* # Any number of spaces. (\s+|;|$) # Ending either at space, semicolon, or EOS. """, re.ASCII | re.VERBOSE),   # re.ASCII may be removed if safe.
    )

## 跨域广播之后 ##

广播完成后脚本跳转到`https://passport.weibo.com/wbsso/login`，然后通常会重定向到`https://weibo.com/ajaxlogin.php`，`redirect`是下一个跳转地址

<html><head><script language='javascript'>parent.sinaSSOController.feedBackUrlCallBack({ "result":true,"userinfo":{ "uniqueid":"......","userid":null,"displayname":null,"userdomain":"?wvr=5&lf=reg"},"redirect":"https:\/\/weibo.com\/nguide\/interest"});</script></head><body></body></html>

`__handle_login_page`中对这个页面的处理如下

# 调用parent.sinaSSOController.feedBackUrlCallBack跳转到weibo.com/nguide/interest
                elif url.startswith('https://weibo.com/ajaxlogin.php'):
                    res_ = self.__get_jsonp_response(res)
                    next_url = res_['redirect']

然后经过一堆重定向到你的微博主页`https://weibo.com/....../home`

# 恢复session #

![恢复session][session]

24小时后session会失效，此时再访问微博首页会被重定向到`https://login.sina.com.cn/sso/login.php`，之后按登录流程处理即可

async def restore_session(self):
            async with self._session.get('https://weibo.com/') as r:
                return await self.__handle_login_page(str(r.url), await r.text())

有时候会重定向到新浪访客系统`https://passport.weibo.com/visitor/visitor?a=enter`，这个页面的脚本也是没有混淆，带中文注释的。不过不管哪种方式最后都会到`https://login.sina.com.cn/sso/login.php`

# 新浪访客系统，用来恢复cookie
                elif url.startswith('https://passport.weibo.com/visitor/visitor'):
                    if 'a=enter' in url:
                        next_url = 'https://passport.weibo.com/visitor/visitor?a=restore&cb=restore_back&from=weibo'
                    else:
                        res_ = self.__get_jsonp_response(res)
                        next_url = (
                            f'https://login.sina.com.cn/sso/login.php?entry=sso&alt={res_["data"]["alt"]}'
                            f'&returntype=META&gateway=1&savestate={res_["data"]["savestate"]}'
                            f'&url=https%3A%2F%2Fweibo.com%2F%3Fdisplay%3D0%26retcode%3D6102'
                        )

[pixiv-to-weibo]: https://github.com/xfgryujk/pixiv-to-weibo/blob/58ba9e9a910159014fa72a0d695ffd51e2c480ba/weibo.py
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3hmZ3J5dWpr_size_16_color_FFFFFF_t_70]: /images/20220215/d5c8aa4a8393493dbf46d811a7648817.png
[sso]: https://i.sso.sina.com.cn/js/wb/sso.js?version=20151126
[session]: /images/20220215/0ed02a0eb2c44381af0c4fd95dbbc087.png