Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/eplus.py (Python)

Code before:
        'params': {
            'skip_download': True,
            'ignore_no_formats_error': True,
        },
        'expected_warnings': [
            'Could not find the playlist URL. This event may not be accessible',
            'No video formats found!',
            'Requested format is not available',
        ],
    }]

    _USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0'
    _TEST_EVENT_URL = 'https://live.eplus.jp/2053935'

    def _perform_login(self, id, password):
        urlh = self._request_webpage(
            self._TEST_EVENT_URL, None, note='Getting auth status', errnote='Unable to get auth status')
        if urlh.url.startswith(self._TEST_EVENT_URL):
            # already logged in
            return

        cltft_token = urlh.headers.get('X-CLTFT-Token')
        if not cltft_token:
            raise ExtractorError('Unable to get X-CLTFT-Token', expected=False)
        self._set_cookie('live.eplus.jp', 'X-CLTFT-Token', cltft_token)

        login_json = self._download_json(
            'https://live.eplus.jp/member/api/v1/FTAuth/idpw', None,
            note='Sending pre-login info', errnote='Unable to send pre-login info', headers={
                'Content-Type': 'application/json; charset=UTF-8',
                'Referer': urlh.url,
                'X-Cltft-Token': cltft_token,
                'Accept': '*/*',
            }, data=json.dumps({
                'loginId': id,
                'loginPassword': password,
            }).encode())
        if not login_json.get('isSuccess'):
            raise ExtractorError('Login failed: Invalid id or password', expected=True)

        self._request_webpage(
            urlh.url, None, note='Logging in', errnote='Unable to log in',
            data=urlencode_postdata({
                'loginId': id,
                'loginPassword': password,
                'Token.Default': cltft_token,
                'op': 'nextPage',
            }), headers={
                'Content-Type': 'application/x-www-form-urlencoded',
                'Referer': urlh.url,
            })

Review comment (security):
In order to retrieve the `X-CLTFT-Token` value, is there a more impartial URL we could request, such as `https://live.eplus.jp/member/auth`? My concern is that if the test event is ever removed / returns 404, then login will break

Code after:
        'params': {
            'skip_download': True,
            'ignore_no_formats_error': True,
        },
        'expected_warnings': [
            'Could not find the playlist URL. This event may not be accessible',
            'No video formats found!',
            'Requested format is not available',
        ],
    }]

    _USER_AGENT = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0'

    def _login(self, username, password, urlh):
        if not self._get_cookies('https://live.eplus.jp/').get('ci_session'):
            raise ExtractorError('Unable to get ci_session cookie')

        cltft_token = urlh.headers.get('X-CLTFT-Token')
        if not cltft_token:
            raise ExtractorError('Unable to get X-CLTFT-Token')
        self._set_cookie('live.eplus.jp', 'X-CLTFT-Token', cltft_token)

        login_json = self._download_json(
            'https://live.eplus.jp/member/api/v1/FTAuth/idpw', None,
            note='Sending pre-login info', errnote='Unable to send pre-login info', headers={
                'Content-Type': 'application/json; charset=UTF-8',
                'Referer': urlh.url,
                'X-Cltft-Token': cltft_token,
                'Accept': '*/*',
            }, data=json.dumps({
                'loginId': username,
                'loginPassword': password,
            }).encode())
        if not login_json.get('isSuccess'):
            raise ExtractorError('Login failed: Invalid id or password', expected=True)

        self._request_webpage(
            urlh.url, None, note='Logging in', errnote='Unable to log in',
            data=urlencode_postdata({
                'loginId': username,
                'loginPassword': password,
                'Token.Default': cltft_token,
                'op': 'nextPage',
            }), headers={'Referer': urlh.url})

    def _real_extract(self, url):
        video_id = self._match_id(url)
        webpage, urlh = self._download_webpage_handle(
            url, video_id, headers={'User-Agent': self._USER_AGENT})
        if urlh.url.startswith('https://live.eplus.jp/member/auth'):
            username, password = self._get_login_info()