Repository: rclone/rclone (language: go)

Issue:
Rclone 1.69 icloud issue: http error 423 “Missing PCS cookies from the request”
I've configured icloud as new remote in rclone 1.69. The configuration with `rclone config` is pretty straightforward, MFA worked, and everything seems configured right.

However `rclone ls <icloud remote name>` fails with `error listing: HTTP error 423 (423 Locked) returned body`[...] `errorReason":"Missing PCS cookies from the request","errorCode":423}"`

```
rclone v1.69.0
- os/version: ubuntu 22.04 (64 bit)
- os/kernel: 5.15.148-tegra (aarch64)
- os/type: linux
- os/arch: arm64 (ARMv8 compatible)
- go/version: go1.23.4
- go/linking: static
- go/tags: none
```

With respect to [asdffdsa](https://forum.rclone.org/u/asdffdsa) and [ncw](https://forum.rclone.org/u/ncw) in https://forum.rclone.org/t/rclone-1-69-icloud-issue-http-error-423-missing-pcs-cookies-from-the-request/49494, I've opened the issue case.

`rclone config reconnect yourremote` finishes successfully, but `rclone ls yourremote` still ends with the identical error message.


Discussion / hints:
@lostb1t have you got time to take a look at this?
As mentioned in the docs. Advanced data protection is not supported.

Disable and try again (make sure to reauthenticate)
Got it. On iPhone > Settings > Apple Account > iCloud > 'Advanced Data Protection' was ON.
--> click 'Turn Off Advanced Data Protection'.

Then, on the Ubuntu system, I removed the remote entry.

I recreated the icloud entry. `rclone ls yourremote` fails, also after a previous `rclone config reconnect yourremote`.

Here's the logfile output.
```
*redacted*@ubuntu:~$ rclone lsd *redacted*: --dump=headers --retries=1
2025/01/15 14:57:28 NOTICE: Automatically setting -vv as --dump is enabled
2025/01/15 14:57:28 DEBUG : rclone: Version "v1.69.0" starting with parameters ["rclone" "lsd" "*redacted*:" "--dump=headers" "--retries=1"]
2025/01/15 14:57:28 DEBUG : Creating backend with remote "*redacted*:"
2025/01/15 14:57:28 DEBUG : Using config file from "/home/*redacted*/.config/rclone/rclone.conf"
2025/01/15 14:57:28 DEBUG : You have specified to dump information. Please be noted that the Accept-Encoding as shown may not be correct in the request and the response may not show Content-Encoding if the go standard libraries auto gzip encoding was in effect. In this case the body of the request will be gunzipped before showing it.
2025/01/15 14:57:28 DEBUG : You have specified to dump information. Please be noted that the Accept-Encoding as shown may not be correct in the request and the response may not show Content-Encoding if the go standard libraries auto gzip encoding was in effect. In this case the body of the request will be gunzipped before showing it.
2025/01/15 14:57:28 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/01/15 14:57:28 DEBUG : HTTP REQUEST (req 0x40000d0000)
2025/01/15 14:57:28 DEBUG : POST /setup/ws/1/validate HTTP/1.1
Host: setup.icloud.com
User-Agent: rclone/v1.69.0
Content-Length: 0
Content-Type: application/json
Cookie: X-APPLE-WEBAUTH-HSA-TRUST=*redacted*;X-APPLE-WEBAUTH-HSA-LOGIN=;X-APPLE-UNIQUE-CLIENT-ID=Cg==;X-APPLE-WEBAUTH-LOGIN=v=1:t=Cg==*redacted*;X-APPLE-WEBAUTH-VALIDATE=v=1:t=Cg==*redacted*;X-APPLE-WEBAUTH-TOKEN=v=2:t=Cg==*redacted*;X-APPLE-WEBAUTH-USER=v=1:s=1:d=*redacted*;X_APPLE_WEB_KB-*redacted*=v=1:t=Cg==*redacted*;X-APPLE-DS-WEB-SESSION-TOKEN=*redacted*;
Origin: https://www.icloud.com
Referer: https://www.icloud.com/
Accept-Encoding: gzip

2025/01/15 14:57:28 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/01/15 14:57:29 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/01/15 14:57:29 DEBUG : HTTP RESPONSE (req 0x40000d0000)
2025/01/15 14:57:29 DEBUG : HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.icloud.com
Access-Control-Expose-Headers: X-Apple-Request-UUID,Via
Cache-Control: no-cache, no-store, private
Connection: keep-alive
Content-Type: application/json; charset=UTF-8
Date: Wed, 15 Jan 2025 13:57:29 GMT
Server: AppleHttpServer/*redacted*
Set-Cookie: X-APPLE-WEBAUTH-VALIDATE="v=1:t=Cg==*redacted*";Path=/;Domain=.icloud.com;Secure
Set-Cookie: X-APPLE-WEBAUTH-TOKEN="v=2:t=Cg==*redacted*";Expires=Fri, 14-Feb-2025 13:57:29 GMT;Path=/;Domain=.icloud.com;Secure;HttpOnly
Set-Cookie: X-APPLE-DS-WEB-SESSION-TOKEN="*redacted*";Expires=Fri, 14-Feb-2025 13:57:29 GMT;Path=/;Domain=.icloud.com;Secure;HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Via: xrail:*redacted*
X-Apple-Edge-Response-Time: 202
X-Apple-Request-Uuid: *redacted*
X-Apple-User-Partition: *redacted*
X-Responding-Instance: setupservice:*redacted*

2025/01/15 14:57:29 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/01/15 14:57:29 DEBUG : icloud: Valid session, no need to reauth
2025/01/15 14:57:29 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/01/15 14:57:29 DEBUG : HTTP REQUEST (req 0x40007a1cc0)
2025/01/15 14:57:29 DEBUG : POST /retrieveItemDetailsInFolders HTTP/1.1
Host: *redacted*-drivews.icloud.com:443
User-Agent: rclone/v1.69.0
Content-Length: 96
Content-Type: application/json
Cookie: X-APPLE-WEBAUTH-HSA-TRUST=*redacted*;X-APPLE-WEBAUTH-HSA-LOGIN=;X-APPLE-UNIQUE-CLIENT-ID=Cg==;X-APPLE-WEBAUTH-LOGIN=v=1:t=Cg==*redacted*;X-APPLE-WEBAUTH-VALIDATE=v=1:t=Cg==*redacted*;X-APPLE-WEBAUTH-USER=v=1:s=1:d=*redacted*;X_APPLE_WEB_KB-*redacted*=v=1:t=Cg==*redacted*;X-APPLE-DS-WEB-SESSION-TOKEN=*redacted*
Origin: https://www.icloud.com
Referer: https://www.icloud.com/
Accept-Encoding: gzip

2025/01/15 14:57:29 DEBUG : >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
2025/01/15 14:57:29 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/01/15 14:57:29 DEBUG : HTTP RESPONSE (req 0x40007a1cc0)
2025/01/15 14:57:29 DEBUG : HTTP/2.0 423 Locked
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: https://www.icloud.com
Access-Control-Expose-Headers: X-Apple-Request-UUID,Via
Cache-Control: no-cache, no-store, private
Content-Type: application/json; charset=UTF-8
Date: Wed, 15 Jan 2025 13:57:29 GMT
Server: AppleHttpServer/*redacted*
Set-Cookie: X-APPLE-WEBAUTH-TOKEN="v=2:t=Cg==*redacted*";Expires=Fri, 14-Feb-2025 13:57:29 GMT;Path=/;Domain=.icloud.com;Secure;HttpOnly
Strict-Transport-Security: max-age=31536000; includeSubDomains;
Via: xrail:*redacted*
X-Apple-Edge-Response-Time: 148
X-Apple-Request-Uuid: *redacted*
X-Apple-User-Partition: *redacted*
X-Responding-Instance: drivews:prod-*redacted*:nocommit

2025/01/15 14:57:29 DEBUG : <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
2025/01/15 14:57:29 ERROR : : error listing: HTTP error 423 (423 Locked) returned body: "{\"requestUUID\":\"*redacted*\",\"errorReason\":\"Missing PCS cookies from the request\",\"errorCode\":423}"
2025/01/15 14:57:29 DEBUG : 6 go routines active
2025/01/15 14:57:29 NOTICE: Failed to lsd with 2 errors: last error was: HTTP error 423 (423 Locked) returned body: "{\"requestUUID\":\"8*redacted*\",\"errorReason\":\"Missing PCS cookies from the request\",\"errorCode\":423}"
```

Is turning off Apple iCloud data protection asynchronous in the meaning of waiting afterwards e.g. 24 hours?
yeah i would give it some time to propagate.

Just make sure to recreate the config entry (there should be no token or cookie set)
Thanks for your insight @lostb1t - perhaps we need a troubleshooting section in the docs. Maybe something like this?

Please correct any mis-understandings in the below!

## Troubleshooting

### Missing PCS cookies from the request

This means you have Advanced data protection turned on. This is not supported at the moment. If you want to use rclone you will have to turn it off (WHERE?).  You should then run `rclone reconnect remote:`.

This doesn't take effect immediately - you may need to wait a few hours or a day before you can get rclone to work - keep running `rclone reconnect remote:` until rclone functions properly.
@ncw If my memory serves me correct i think we can see when ADP is enabled by on authentication. And its on my todo to create a check and proper error message for it

and yeah some extra info to the readme doesn't hurt
I added it yesterday and it authenticated and 2fa'd just fine, but i didn't realize at the time that it wouldn't work with advanced data protection. I disable ADP and recreated the connection but ever since I have been getting this error:

```
rclone config reconnect icloud:
Error: HTTP error 400 (400 Bad Request) returned body: "{\"success\":false,\"error\":\"Invalid Session Token\"}"
Usage:
  rclone config reconnect remote: [flags]

Flags:
  -h, --help   help for reconnect

Use "rclone [command] --help" for more information about a command.
Use "rclone help flags" for to see the global flags.
Use "rclone help backends" for a list of supported services.

2025/01/15 08:05:38 NOTICE: Fatal error: HTTP error 400 (400 Bad Request) returned body: "{\"success\":false,\"error\":\"Invalid Session Token\"}"
```

I remade it multiple times, I switched from the brew release to the conda release, I waited a day and remade it and now no matter what I do it gives me this error. Any ideas?
@xrishox make sure there are no token or cooky fields in the config before rauthenticatiins

and to check: app passwords are not supported use username/password
On iPhone, Settings > Apple Account > iCloud > 'Access iCloud Data on the Web' must be ON, and 'Advanced Data Protection' OFF.
After I recreated the icloud entry, `rclone ls <yourremote>:` works flawlessly. The error 423 is gone.
In the docs, yes, indeed it would be helpful to mention both settings.

The following directories are visible with `rclone lsd <yourremote>:`
- Downloads
- Pages
- Shortcuts

Does someone know how to make Photos and Movies eligible as well?

To the rclone developers: Awesome product!

The issue with error 400 must be (yet) another constellation as it is described with `invalid session token`.
issue resolved > close ticket

Fix patch:
diff --git a/docs/content/iclouddrive.md b/docs/content/iclouddrive.md
index 63023969b9f27..299cb064a3be8 100644
--- a/docs/content/iclouddrive.md
+++ b/docs/content/iclouddrive.md
@@ -61,7 +61,7 @@ Enter a value.
 config_2fa> 2FACODE
 Remote config
 --------------------
-[koofr]
+[iclouddrive]
 - type: iclouddrive
 - apple_id: APPLEID
 - password: *** ENCRYPTED ***
@@ -78,6 +78,20 @@ y/e/d> y
 
 ADP is currently unsupported and need to be disabled
 
+On iPhone, Settings `>` Apple Account `>` iCloud `>` 'Access iCloud Data on the Web' must be ON, and 'Advanced Data Protection' OFF.
+
+## Troubleshooting
+
+### Missing PCS cookies from the request
+
+This means you have Advanced Data Protection (ADP) turned on. This is not supported at the moment. If you want to use rclone you will have to turn it off. See above for how to turn it off.
+
+You will need to clear the `cookies` and the `trust_token` fields in the config. Or you can delete the remote config and start again.
+
+You should then run `rclone reconnect remote:`.
+
+Note that changing the ADP setting may not take effect immediately - you may need to wait a few hours or a day before you can get rclone to work - keep clearing the config entry and running `rclone reconnect remote:` until rclone functions properly.
+
 {{< rem autogenerated options start" - DO NOT EDIT - instead edit fs.RegInfo in backend/iclouddrive/iclouddrive.go then run make backenddocs" >}}
 ### Standard options
 


Test patch: