Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/laxarxames.py (Python)

Code before:
        },
        'skip': 'Requires login',
    }]

    def _perform_login(self, username, password):
        if self._TOKEN:
            return
        login = self._download_json(
            'https://api.laxarxames.cat/Authorization/SignIn', None, note='Logging in', headers={
                'X-Tenantorigin': 'https://laxarxames.cat',
                'Content-Type': 'application/json',
            }, data=json.dumps({
                'Username': username,
                'Password': password,
                'Device': {
                    'PlatformCode': 'WEB',
                    'Name': 'Mac OS ()',
                },
            }).encode('utf-8'),
            expected_status=401,
        )

        if not traverse_obj(login, ('AuthorizationToken', 'Token')):
            raise ExtractorError('Login failed', expected=True)
        else:
            self._TOKEN = login['AuthorizationToken']['Token']

    def _real_extract(self, url):
        video_id = self._match_id(url)

        if not self._TOKEN:
            self.raise_login_required()
        mediaplayinfo = self._download_json(
            'https://api.laxarxames.cat/Media/GetMediaPlayInfo', video_id,
            data=json.dumps({
                'MediaId': int(video_id),
                'StreamType': 'MAIN'
            }).encode('utf-8'),
            headers={
                'Authorization': 'Bearer ' + self._TOKEN,
                'X-Tenantorigin': 'https://laxarxames.cat',
                'Content-Type': 'application/json',
            }
        )

        if not mediaplayinfo.get('ContentUrl'):
            self.raise_no_formats('No video found', expected=True)
        return self.url_result(
            f'http://players.brightcove.net/5779379807001/default_default/index.html?videoId={mediaplayinfo["ContentUrl"]}',
            BrightcoveNewIE, video_id, mediaplayinfo.get('Title'))


Review comment (security):
```suggestion
        self._TOKEN = login['AuthorizationToken']['Token']
```

Code after:
        'skip': 'Requires login',
    }]

    def _perform_login(self, username, password):
        if self._TOKEN:
            return

        login = self._download_json(
            'https://api.laxarxames.cat/Authorization/SignIn', None, note='Logging in', headers={
                'X-Tenantorigin': 'https://laxarxames.cat',
                'Content-Type': 'application/json',
            }, data=json.dumps({
                'Username': username,
                'Password': password,
                'Device': {
                    'PlatformCode': 'WEB',
                    'Name': 'Mac OS ()',
                },
            }).encode(), expected_status=401)

        self._TOKEN = traverse_obj(login, ('AuthorizationToken', 'Token', {str}))
        if not self._TOKEN:
            raise ExtractorError('Login failed', expected=True)

    def _real_extract(self, url):
        video_id = self._match_id(url)
        if not self._TOKEN:
            self.raise_login_required()

        media_play_info = self._download_json(
            'https://api.laxarxames.cat/Media/GetMediaPlayInfo', video_id,
            data=json.dumps({
                'MediaId': int(video_id),
                'StreamType': 'MAIN'
            }).encode(), headers={
                'Authorization': f'Bearer {self._TOKEN}',
                'X-Tenantorigin': 'https://laxarxames.cat',
                'Content-Type': 'application/json',
            })

        if not traverse_obj(media_play_info, ('ContentUrl', {str})):
            self.raise_no_formats('No video found', expected=True)

        return self.url_result(
            f'https://players.brightcove.net/5779379807001/default_default/index.html?videoId={media_play_info["ContentUrl"]}',
            BrightcoveNewIE, video_id, media_play_info.get('Title'))