Question

我一直试图用登录抓一个网站（使用yelp）。第一个问题是为了更好地理解：我按照一些教程来获取想法，并注意到他们都使用CSRF令牌制作词典，但是，当我刮到yelp登录站点时，我找到了6个令牌。我知道我不能在字典中有重复的密钥，因此教程使用字典来解决这个冗余/不正确的问题，因为我只会得到最后一个令牌？

其次，如果有多个令牌，你使用哪个？或者你如何使用它们？我似乎无法登录工作并阅读了BeautifulSoup和Requests的文档，并在昨晚搜索了Stack。代码如下。谢谢你的任何解释。

s = requests.session()
login = s.get('https://www.yelp.com/login')

soup = BeautifulSoup(login.text, 'html.parser')
tokenList = soup.find_all(type = 'hidden', attrs={"name": "csrftok"})
c = login.cookies  #Just peeked into cookies to see if there is a token 
print(c)

keys = [x.attrs["name"] for x in tokenList]
values = [x.attrs["value"] for x in tokenList]
#If I print these two lists, I get 6 keys of the "csrftok" String, and 6 
#different keys.  

email = "my email"
password = "my password"
#I tried creating a dictionary with zip of all the tokens, etc. This 
#is an attempt just using the first key and value I find.
d = {'email': email, 'password': password, keys[0]: values[0]}
response = s.post('https://www.yelp.com/login', data = d)

print(response.url)

Answer 1

你试过这样的尝试吗？我认为它应该引导你走向正确的方向：

s = requests.session()
login = s.get('https://www.yelp.com/login')

soup = BeautifulSoup(login.text, 'lxml')
token = soup.select(".csrftok")[0]['value']

email = "my email"
password = "my password"

headers={
'accept':'application/json, text/javascript, */*; q=0.01',
'accept-encoding':'gzip, deflate, br',
'content-type':'application/x-www-form-urlencoded; charset=UTF-8',
'referer':'https://www.yelp.com/login',
'user-agent':'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36',
'x-distil-ajax':'fytrybseesxsvsresb',
'x-requested-with':'XMLHttpRequest'
}

payload = {
'csrftok':token,
'email':email,
'password':password,
}

response = s.post('https://www.yelp.com/login/newajax', data = payload, headers=headers)
print(response.url)

使用多个令牌发布CSRF令牌？

1 个答案: