Found this content helpful? Log in or sign up to leave a like!

GraphQL authentication using browser cookies

sakura_GX
Community Novice
Wednesday

i have a python script that attempts to get assignments using the graphql API and replicating the request send when you klick the execute button (note we  neither can  nor will ever use oath2 because we do not have the resources to get verified ) 

 

#!python

import browser_cookie3
import requests
import json
cj = browser_cookie3.chromium(domain_name='iusd.instructure.com')
print(cj)

    
    

def send(cj):
    token = None
    for i in cj:
        if "<Cookie _csrf_token=" in str(i):
            token = str(i).replace("<Cookie _csrf_token=","").replace(" for iusd.instructure.com/>","")
    url = "https://iusd.instructure.com/api/graphql"


    headers = {
        "accept": "application/json+canvas-string-ids, application/json, text/plain, */*",
        "accept-language": "en-US,en;q=0.9",
        "baggage": "sentry-environment=Production,sentry-release=canvas-lms@20250409.326,sentry-public_key=355a1d96717e4038ac25aa852fa79a8f,sentry-trace_id=a62f30e1b8bc4d8bbedaa00fb431462d",
        "content-type": "application/json",
        "priority": "u=1, i",
        "sec-ch-ua": "\"Chromium\";v=\"133\", \"Not(A:Brand\";v=\"99\"",
        "sec-ch-ua-mobile": "?0",
        "sec-ch-ua-platform": "\"Linux\"",
        "sec-fetch-dest": "empty",
        "sec-fetch-mode": "cors",
        "sec-fetch-site": "same-origin",
        "sentry-trace": "",
        "x-csrf-token": token,
        "x-requested-with": "XMLHttpRequest"
    }
    # GraphQL query
    query = """
    {
        allCourses {
          name
          _id
          submissionsConnection(filter: {states: submitted}) {
            nodes {
              gradingStatus
              submissionStatus
              submittedAt
              state
              assignment {
                _id
                name
              }
              user {
                _id
                name
                sisId
                email
                enrollments {
                  state
                  course {
                    _id
                  }
                }
              }
            }
          }
          term {
            sisTermId
            name
          }
        }
    }
    """

    payload = json.dumps({
        "query": query,
        "variables": None
    })

    try:
        response = requests.post(url, headers=headers, data=payload,cookies=cj)
        print(response.request.headers)
        response.raise_for_status()  # Raises an HTTPError if the response code was unsuccessful
        print(response.json())
        return response
    except requests.exceptions.HTTPError as errh:
        print(f"HTTP Error: {errh}")
    except Exception as e:
        print(f"An error occurred: {e}")

if __name__ == "__main__":
    send(cj)

the current code uses  browser_cookie3 to gain all the cookies from a canvas instance (in this case a institution i am part of) and then it attempts to list assignments however  we get a 422 error.

i understand that the csrf token refreshes after each request but this was after the last request was in browser.   we need the data to create a todolist and no asking our clients to generate devkeys is not going to cut it 

HTTP Error: 422 Client Error: Unprocessable Entity for url: https://iusd.instructure.com/api/graphql

 

Labels (2)
Labels
0 Likes