关于 wbi 接口鉴权 -403 问题 #290

z0z0r4 · 2023-05-19T13:17:00Z

部分接口不带鉴权参数的话可能有较高限制，已经影响使用

params = {
    "token": "",
    "platform": "web",
    "web_location": "1550101",
    "w_rid": "8104c972a8504c4ea699000d3e752d56",
    "wts": "1684501344"
}

此 issue 汇总出问题的接口，并扒拉如何获取鉴权参数

z0z0r4 · 2023-05-19T13:19:25Z

具体体现

{'code': -403, 'message': '访问权限不足', 'ttl': 1}

Ofnoname · 2023-05-19T13:30:21Z

具体体现

{'code': -403, 'message': '访问权限不足', 'ttl': 1}

我也遇到这个问题了，但是以前没有，我觉得是b站反爬策略更新了

z0z0r4 · 2023-05-19T13:31:12Z

具体体现
{'code': -403, 'message': '访问权限不足', 'ttl': 1}
我也遇到这个问题了，但是以前没有，我觉得是b站反爬策略更新了

是反爬更新了

z0z0r4 · 2023-05-19T13:33:28Z

目测路径带 /wbi 的接口都有这个问题

z0z0r4 · 2023-05-19T13:34:20Z

SocialSisterYi/bilibili-API-collect#631

HoshimiStellae · 2023-05-20T03:02:53Z

下周就要答辩了，突然出现这个问题，好崩溃

Drelf2018 · 2023-05-20T03:06:34Z

下周就要答辩了，突然出现这个问题，好崩溃

用爬虫答辩的吗，是自动收集信息之类？现在接口不是完全不能用，间隔时间长点还能获取到数据。或许你可以先在本地爬好多份数据，答辩的时候展示一下。

z0z0r4 · 2023-05-20T09:13:04Z

下周就要答辩了，突然出现这个问题，好崩溃

要用到限制的接口？如果你急用还是可以解决的，加我qq3531890582

Drelf2018 · 2023-05-20T09:36:49Z

import hashlib
import time
from functools import reduce

import httpx
from bilibili_api import HEADERS


def getMixinKey(ae):
    oe = [46, 47, 18, 2, 53, 8, 23, 32, 15, 50, 10, 31, 58, 3, 45, 35, 27, 43, 5, 49, 33, 9, 42, 19, 29, 28, 14, 39, 12, 38, 41, 13, 37, 48, 7, 16, 24, 55, 40, 61, 26, 17, 0, 1, 60, 51, 30, 4, 22, 25, 54, 21, 56, 59, 6, 63, 57, 62, 11, 36, 20, 34, 44, 52]
    le = reduce(lambda s, i: s + ae[i], oe, "")
    return le[:32]


def md5(s: str):
    return hashlib.md5(s.encode(encoding='utf-8')).hexdigest()


def split(s: str):
    return s.split("/")[-1].split(".")[0]


def encWbi():
    resp = httpx.get("https://api.bilibili.com/x/web-interface/nav")
    wbi_img: dict = resp.json()["data"]["wbi_img"]
    fe = wbi_img.get("img_url")
    he = wbi_img.get("sub_url")
    de = split(fe)
    pe = split(he)
    me = getMixinKey(de + pe)
    ve = int(time.time())
    Ae = f"ids=3449&pf=0&wts={ve}"
    Me = md5(Ae + me)
    return Me, ve


def test(uid: int):
    Me, ve = encWbi()
    resp = httpx.get(
        url="https://api.bilibili.com/x/space/wbi/acc/info",
        params={
            "mid": str(uid),
            "token": "",
            "platform": "web",
            "web_location": "1550101",
            "w_rid": Me,
            "wts": str(ve)
        },
        headers=HEADERS
    )

    try:
        data = resp.json()
        name = data["data"]["name"]
        print(f"{name} UID: {uid}")
        return True
    except:
        print(data)
        return False


count = 0
succeed = 0
while True:
    count += 1
    if test(434334701):
        succeed += 1
    print(f"{100 * succeed / count}%")

成功率只有 52%

z0z0r4 · 2023-05-20T09:53:11Z

到家，52%可还行？我来试试看搓一份吧

z0z0r4 · 2023-05-20T10:00:42Z

Ae = f"ids=3449&pf=0&wts={ve}" 是这样的吗？

感觉这个应该随着传入的 params 而变，像网易云的接口一样？

注意这张图上的参数欸... ids=3449&pf=0 ~~我倒是好奇怎么有52%的成功率~~

getMixinKey 没问题

z0z0r4 · 2023-05-20T10:20:28Z

...?生成的wrid也没问题，什么鬼

Ofnoname · 2023-05-20T10:26:15Z

意思是，每次根据要传入的参数还要给出一个w_rid，算法就在b站页面的代码里吗

z0z0r4 · 2023-05-20T10:57:32Z

我已经改好了XD

Drelf2018 · 2023-05-20T10:58:27Z

细说

z0z0r4 · 2023-05-20T10:59:52Z

import hashlib
import time
from functools import reduce

import httpx

HEADERS = {"User-Agent": "Mozilla/5.0", "Referer": "https://www.bilibili.com"}


def getMixinKey(ae):
    oe = [46, 47, 18, 2, 53, 8, 23, 32, 15, 50, 10, 31, 58, 3, 45, 35, 27, 43, 5, 49, 33, 9, 42, 19, 29, 28, 14, 39, 12, 38, 41,
          13, 37, 48, 7, 16, 24, 55, 40, 61, 26, 17, 0, 1, 60, 51, 30, 4, 22, 25, 54, 21, 56, 59, 6, 63, 57, 62, 11, 36, 20, 34, 44, 52]
    le = reduce(lambda s, i: s + ae[i], oe, "")
    return le[:32]


def md5(s: str):
    return hashlib.md5(s.encode(encoding='utf-8')).hexdigest()


def split(s: str):
    return s.split("/")[-1].split(".")[0]


def encWbi(params: dict):
    resp = httpx.get("https://api.bilibili.com/x/web-interface/nav")
    wbi_img: dict = resp.json()["data"]["wbi_img"]
    img_url: str = wbi_img.get("img_url")
    sub_url: str = wbi_img.get("sub_url")
    img_value = split(img_url)
    sub_value = split(sub_url)
    me = getMixinKey(img_value + sub_value)
    wts = int(time.time())
    params["wts"] = wts
    Ae = "&".join([f'{key}={value}' for key, value in params.items()])
    w_rid = md5(Ae + me)
    return w_rid, wts


def main(uid: int):
    url_params = {"mid": uid}
    w_rid, wts = encWbi(url_params)
    params = {
            "w_rid": w_rid,
            "wts": wts,
        }
    params.update(url_params)
    resp = httpx.get(
        url="https://api.bilibili.com/x/space/wbi/acc/info",
        params=params,
        headers=HEADERS
    )

    print(resp.url, resp.json())

main(uid=558830935)

z0z0r4 · 2023-05-20T11:01:30Z

emm，我去写pr了？刚放学好累，先吃饭

Drelf2018 · 2023-05-20T11:05:28Z

辛苦了

z0z0r4 · 2023-05-20T11:34:31Z

话说如果每次请求都重新获取 wbi 的 MixinKey 将严重拖慢速度吧，有哪里可以当作项目的环境变量存起来吗.jpg

以及需要检测下 nav 的那个 wbi_img_url 多久换一次

z0z0r4 · 2023-05-20T12:21:39Z

受不了了，立 flag +1，为什么传api只传url，不能整个扔过去吗...~~谁设计的.jpg~~

Drelf2018 · 2023-05-20T12:35:59Z

为什么传api只传url，不

什么意思

z0z0r4 · 2023-05-20T12:38:23Z

z0z0r4 · 2023-05-20T12:39:02Z

本来打算靠这个判断要不要 wbi 的

z0z0r4 · 2023-05-20T12:43:08Z

@Drelf2018 能麻烦你有空的话test一下吗？我看看待会发release...

Drelf2018 · 2023-05-20T12:43:12Z

from bilibili_api.utils.utils import get_api


API = get_api("user")
print(API["info"]["info"])

你看看吧，接口信息都有的。

z0z0r4 · 2023-05-20T12:45:10Z

from bilibili_api.utils.utils import get_api
你看看吧，接口信息都有的。

我说的是传入 request 的时候

Drelf2018 · 2023-05-20T12:51:04Z

我还是没看懂，你想用 json 文件里的 "wbi": true 判断要不要传入 wbi 吗？

from bilibili_api.utils.utils import get_api


API = get_api("user")


async def func():
    api = API["info"]["info"]
    if api["wbi"]:
        ...

    params = {"mid": self.__uid, "w_rid": ..., "wts": ...}
    return await request(
        "GET", url=api["url"], params=params, credential=self.credential
    )

这个意思吗

z0z0r4 · 2023-05-20T12:55:17Z

from bilibili_api.utils.utils import get_api
API = get_api("user")
api = API["info"]["info"]
return await request(api, params, crd)

包括接口的 comment，verify 等信息都传进去处理

z0z0r4 · 2023-05-20T12:55:38Z

@Drelf2018 能麻烦你有空的话test一下吗？我看看待会发release...

能跑吗？我给B站风控了...

z0z0r4 · 2023-05-20T12:56:22Z

本来打算靠这个判断要不要 wbi 的

request 读取这里面的 wbi: true 直接判断，接口信息写了就应该传入用上

z0z0r4 · 2023-05-20T13:27:56Z

@Drelf2018 能麻烦你有空的话test一下吗？我看看待会发release...

能跑吗？我给B站风控了...

算了不测了，我风控前好像能跑，发了

z0z0r4 · 2023-05-20T13:40:50Z

https://github.com/Nemo2011/bilibili-api/releases/tag/15.4.3

暂待反馈

Drelf2018 · 2023-05-20T14:22:53Z

你太着急了

bilibili-api/bilibili_api/data/api/credential.json

Lines 1 to 7 in 5f1d82b

    
           { 
        
               "valid": { 
        
                   "url": "https://api.bilibili.com/x/web-interface/nav",  
        
                   "verify": true,  
        
                   "comment": "如果 code = 0 则 cookies 有效" 
        
               } 
        
           }

这种库里本来就有的东西不应该重复添加
提交之前先全局搜索下啊

z0z0r4 · 2023-05-20T15:40:02Z

你太着急了

bilibili-api/bilibili_api/data/api/credential.json

Lines 1 to 7 in 5f1d82b

{

"valid": {

"url": "https://api.bilibili.com/x/web-interface/nav",

"verify": true,

"comment": "如果 code = 0 则 cookies 有效"

}

}

这种库里本来就有的东西不应该重复添加
提交之前先全局搜索下啊

明天吧，没去搜

reitowo · 2023-05-22T07:02:27Z

有没有定论了，WBI多久更新一次

z0z0r4 · 2023-05-23T04:29:52Z

SocialSisterYi/bilibili-API-collect#631 (comment)

Tiny1213 · 2023-05-23T06:09:14Z

我今天刚跑了，貌似还不行，还是一直卡着，奇怪的是没有抛出异常

z0z0r4 · 2023-05-23T14:17:20Z

@Drelf2018 参数要排序，我忘了xd，能改改吗？在学校我没法整

z0z0r4 · 2023-05-23T14:18:36Z

SocialSisterYi/bilibili-API-collect#631 (comment)

Drelf2018 · 2023-05-23T16:23:06Z

@Drelf2018 参数要排序，我忘了xd，能改改吗？在学校我没法整

#301 唉，重写

reitowo · 2023-05-24T09:03:27Z

C#示例

      private string _wbiString;
      private DateTime _wbiTime;

      private async Task<string> WbiKey(Dictionary<string, string> param) {
         if (_wbiString == null || _wbiTime.AddHours(1) < DateTime.Now || _wbiTime.Day != DateTime.Now.Day) {
            var info = await _statefulClient.GetStringAsync($"https://api.bilibili.com/x/web-interface/nav");
            Logger.LogTrace(info);

            var json = JObject.Parse(info);
            var imgUrl = json["data"]!["wbi_img"]!["img_url"]!.Value<string>();
            var subUrl = json["data"]!["wbi_img"]!["sub_url"]!.Value<string>();
            var img = imgUrl.Split("/")[^1].Split(".")[0];
            var sub = subUrl.Split("/")[^1].Split(".")[0];
            var ae = img + sub;
            Logger.LogTrace(ae);
            var oe = new[] {
               46, 47, 18, 2, 53, 8, 23, 32, 15, 50, 10, 31, 58, 3, 45, 35, 27, 43, 5, 49, 33, 9, 42,
               19, 29, 28, 14, 39, 12, 38, 41, 13, 37, 48, 7, 16, 24, 55, 40, 61, 26, 17, 0, 1, 60, 51, 30, 4, 22, 25,
               54, 21, 56, 59, 6, 63, 57, 62, 11, 36, 20, 34, 44, 52
            };
            var le = oe.Aggregate("", (s, b) => s + ae[b]);
            _wbiString = le[..32];
            _wbiTime = DateTime.Now;
         }

         var wts = DateTimeOffset.Now.ToUnixTimeSeconds();
         param["wts"] = wts.ToString();
         var str = string.Join("&",
            param.ToImmutableSortedDictionary(StringComparer.Ordinal).Select(a => $"{a.Key}={a.Value}"));
         Logger.LogTrace(str);
         param["w_rid"] = Convert.ToHexString(MD5.HashData(Encoding.UTF8.GetBytes(str + _wbiString))).ToLower();

         return string.Join("&", param.Select(a => $"{a.Key}={a.Value}"));
      }

z0z0r4 · 2023-05-24T09:12:52Z

这是py库。。。

reitowo · 2023-05-24T11:16:48Z

这是py库。。。

基本上都是来找api找用例的，搬到不同语言用很正常，这里也算是这个问题的门户了

z0z0r4 · 2023-05-25T04:28:47Z

这是py库。。。

基本上都是来找api找用例的，搬到不同语言用很正常，这里也算是这个问题的门户了

建议去 https://github.com/SocialSisterYi/bilibili-API-collect

z0z0r4 · 2023-05-27T12:06:11Z

https://pypi.org/project/bilibili-api-python/15.4.4/ Fixed

z0z0r4 added the bug 漏洞 label May 19, 2023

z0z0r4 pinned this issue May 19, 2023

z0z0r4 mentioned this issue May 19, 2023

【提问】user.get_user_info()、user.get_videos()和user.get_dynamics()接口无法获取到有效信息，但是没有错误信息被抛出 #289

Closed

z0z0r4 changed the title ~~关于接口鉴权 -403 问题~~ 关于 wbi 接口鉴权 -403 问题 May 19, 2023

z0z0r4 mentioned this issue May 19, 2023

【漏洞】user.get_live_info 接口失败 #262

Closed

z0z0r4 mentioned this issue May 20, 2023

网页端接口大部分都换成wbi，需要w_rid了 SocialSisterYi/bilibili-API-collect#631

Closed

z0z0r4 mentioned this issue May 20, 2023

wbi 鉴权 #294

Merged

z0z0r4 added the solved 已解决 label May 20, 2023

RtYkk mentioned this issue May 22, 2023

[Bug] 脚本无法运行，提示API.x.getAccInfo 获取账号信息失败访问权限不足 andywang425/BLTH#381

Closed

Polaris-cn10086 mentioned this issue May 23, 2023

【Bug】部分api会提示“访问权限不足” RayWangQvQ/BiliBiliToolPro#543

Closed

z0z0r4 mentioned this issue May 23, 2023

【漏洞】Wbi 鉴权 #300

Closed

z0z0r4 closed this as completed May 27, 2023

z0z0r4 unpinned this issue Jun 5, 2023

Ailitonia mentioned this issue Jun 27, 2023

BUG: bilibili 用户信息接口风控问题 Ailitonia/omega-miya#126

Closed

关于 wbi 接口鉴权 -403 问题 #290

关于 wbi 接口鉴权 -403 问题 #290

Comments

z0z0r4 commented May 19, 2023

z0z0r4 commented May 19, 2023

Ofnoname commented May 19, 2023

z0z0r4 commented May 19, 2023

z0z0r4 commented May 19, 2023

z0z0r4 commented May 19, 2023

HoshimiStellae commented May 20, 2023

Drelf2018 commented May 20, 2023 • edited Loading

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023 • edited Loading

z0z0r4 commented May 20, 2023 • edited Loading

z0z0r4 commented May 20, 2023 • edited Loading

z0z0r4 commented May 20, 2023

Ofnoname commented May 20, 2023

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023 • edited Loading

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023 • edited Loading

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

z0z0r4 commented May 20, 2023

Drelf2018 commented May 20, 2023

z0z0r4 commented May 20, 2023

reitowo commented May 22, 2023

z0z0r4 commented May 23, 2023

Tiny1213 commented May 23, 2023

z0z0r4 commented May 23, 2023 • edited Loading

z0z0r4 commented May 23, 2023

Drelf2018 commented May 23, 2023

reitowo commented May 24, 2023 • edited Loading

z0z0r4 commented May 24, 2023

reitowo commented May 24, 2023 • edited Loading

z0z0r4 commented May 25, 2023

z0z0r4 commented May 27, 2023

Drelf2018 commented May 20, 2023 •

edited

Loading

Drelf2018 commented May 20, 2023 •

edited

Loading

z0z0r4 commented May 20, 2023 •

edited

Loading

z0z0r4 commented May 20, 2023 •

edited

Loading

Drelf2018 commented May 20, 2023 •

edited

Loading

Drelf2018 commented May 20, 2023 •

edited

Loading

z0z0r4 commented May 23, 2023 •

edited

Loading

reitowo commented May 24, 2023 •

edited

Loading

reitowo commented May 24, 2023 •

edited

Loading