Why?

[Herbert]

It’s not the client cookie, It’s the website’s cookie.

[Herbert]

Just to be clear guys, What I showed was a different method. Like @ChrisPAR you can’t directly access using just CURL. So don’t get me wrong for posting things like this.

@Herbert

Mmm, I am not sure about apps, but if you want to make a CURL request, you can add headers to it, so it’ll act as a browser. This is how I sent the request to my site. Although CURL doesn’t support JS, in that case you need to add the website’s cookie to the header, or you can set the --cookie flag to the request. (If you are using this request on a https request, then you need to modify a bit since CURL is not responding well to https requests.)

[anon50163844]

*Big brain emoji
I guess curl actually works. So there’s no cookie validation whatsoever? But I hit the security system instead

[YT_Xaos]

@anon50163844

I guess curl actually works.

It does not because:

@anon50163844

I hit the security system instead

However, when Herbert did it, it worked, not sure how (and yes I did try to set the cookie).

[Greenreader9]

@YT_Xaos

it worked, not sure how

Because he had the cookie there

[YT_Xaos]

That is why I said this:

@YT_Xaos

and yes I did try to set the cookie

I’ll try again in a few minutes or tomorrow (it is 8:59 PM currently and I have school tomorrow).
–EDIT–
I just tried it and it worked!

[Herbert]

@Greenreader9

Because he had the cookie there

That’s correct, without the cookies JS won’t work.

[Herbert]

[anon50163844]

still doesn’t work for me

[YT_Xaos]

You are using Herbert’s cookie! Go to dev tools > Application > Cookies and copy the value for __test.

[wackyblackie]

A whole new solution would be to use headless chrome or Firefox. Maybe that would work. I’ve never used a headless browser before, though.

[Ziverre]

The whole conclusion for me is that this security system sucks.

[Greenreader9]

Yeah, that works. Or just re-invent the cookie.

[Admin]

The cookie is not a static value. You can’t just copy it once and reuse it forever. That would make it way too easy to bypass the security system.

@Ziverre

The whole conclusion for me is that this security system sucks.

It sounds to me like it’s doing exactly what it’s intended to do.

[Ziverre]

@Admin

It sounds to me like it’s doing exactly what it’s intended to do.

Intended to prevent bots from accessing but some easy trick bypasses it.

[anon50163844]

How to see devtools on android?

[YT_Xaos]

I don’t have an Andriod so I wouldn’t be able to tell you with certainty that this works but here’s an article:

ניפוי באגים מרחוק במכשירי Android  |  DevTools  |  Chrome...

Alternatively, this is what Bing AI told me:

1. Open Chrome on your Android device.
2. Go to the page you want to debug.
3. Add view-source: at the beginning of the URL (e.g., view-source:https://www.example.com) and press Enter. This will display the source code of the page.
4. Tap on any line of the source code. This will bring up a toolbar at the bottom of the screen.
5. Tap on the “Inspect” icon (it looks like a magnifying glass) on the toolbar.

[Herbert]

@Admin

It sounds to me like it’s doing exactly what it’s intended to do.

Hey Admin, The current cookie security mechanism is indeed preventing bots, but wouldn’t it be more efficient if you set the cookie value to reset for each request? This would improve the system. It’s just an idea, though!

[Ziverre]

It would unnecessarily slow down page load time + break media linked in it, it would still be bypassable by a bot which uses headless browser.

[Herbert]

Yeah but it’ll add another security layer though. Why not using CAPTCHA? It’s very effective against bots.