quantfortune/SIP_GoldBees_Backend
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix auto-login: remove Referer header, add Accept/Origin headers

Browse Source 
Referer on POST was causing Zerodha to reject login with Invalid username.
Add Accept, Accept-Language, Origin headers for proper browser-like requests.
Keep redirect_url body check for twofa. Add login step debug logging.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Thigazhezhilan J 2026-05-26 21:28:09 +05:30
parent 4922ea69e8
commit dc663a129c
1 changed files with 14 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
backend/app/services/auto_login_service.py
View File

@ -176,44 +176,42 @@ def _perform_zerodha_login(
) -> dict: ) -> dict:
"""Automates Zerodha login and returns session data with access_token.""" """Automates Zerodha login and returns session data with access_token."""
session = requests.Session() session = requests.Session()
# Use a real browser UA; do NOT set X-Kite-Version here — that header is
# for the Kite Connect REST API, not the web login endpoints, and confuses
# Zerodha's routing so it returns a plain profile response instead of an
# OAuth redirect_url.
session.headers.update({ session.headers.update({
"User-Agent": ( "User-Agent": (
"Mozilla/5.0 (Windows NT 10.0; Win64; x64) " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
"AppleWebKit/537.36 (KHTML, like Gecko) " "AppleWebKit/537.36 (KHTML, like Gecko) "
"Chrome/124.0.0.0 Safari/537.36" "Chrome/124.0.0.0 Safari/537.36"
), ),
"Accept": "application/json, text/plain, */*",
"Accept-Language": "en-US,en;q=0.9",
"Origin": "https://kite.zerodha.com",
}) })
# Step 1: Initialize OAuth session. # Step 1: Initialize OAuth session so Zerodha associates this session with
# Use allow_redirects=False so we capture the Set-Cookie from the first # the api_key before we submit credentials.
# response before any redirect overwrites/clears the OAuth context cookie.
connect_resp = session.get( connect_resp = session.get(
f"https://kite.zerodha.com/connect/login?v=3&api_key={api_key}", f"https://kite.zerodha.com/connect/login?v=3&api_key={api_key}",
timeout=15, timeout=15,
allow_redirects=False, allow_redirects=True,
) )
print( print(
f"[AUTO-LOGIN-DEBUG] connect status={connect_resp.status_code} " f"[AUTO-LOGIN-DEBUG] connect final_url={connect_resp.url} "
f"location={connect_resp.headers.get('Location', 'NONE')} " f"status={connect_resp.status_code} "
f"cookies={list(session.cookies.keys())}", f"cookies={list(session.cookies.keys())}",
flush=True, flush=True,
) )
# Follow the redirect to the login page so the full OAuth init completes
redirect_to = connect_resp.headers.get("Location", "")
if connect_resp.status_code in (301, 302, 303, 307, 308) and redirect_to:
session.get(redirect_to, timeout=15, allow_redirects=True)
# Step 2: Username + password # Step 2: Username + password
login_resp = session.post( login_resp = session.post(
KITE_LOGIN_ENDPOINT, KITE_LOGIN_ENDPOINT,
data={"user_id": zerodha_login_id, "password": password}, data={"user_id": zerodha_login_id, "password": password},
headers={"Referer": "https://kite.zerodha.com/login"},
timeout=15, timeout=15,
) )
print(
f"[AUTO-LOGIN-DEBUG] login status={login_resp.status_code} "
f"body={login_resp.text[:300]}",
flush=True,
)
try: try:
login_data = login_resp.json() login_data = login_resp.json()
except Exception: except Exception:
@ -238,7 +236,6 @@ def _perform_zerodha_login(
"twofa_value": totp_value, "twofa_value": totp_value,
"twofa_type": "totp", "twofa_type": "totp",
}, },
headers={"Referer": "https://kite.zerodha.com/login"},
timeout=15, timeout=15,
allow_redirects=False, allow_redirects=False,
) )
@ -250,7 +247,7 @@ def _perform_zerodha_login(
) )
# Step 4: Extract request_token. # Step 4: Extract request_token.
# Modern Zerodha (SPA): returns 200 JSON with data.redirect_url containing request_token. # Modern Zerodha (SPA): returns 200 JSON with data.redirect_url.
# Older behavior: 302 Location header redirect. # Older behavior: 302 Location header redirect.
request_token = None request_token = None