Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/twitter.py (Python)

Code before:
        video_url = strip_or_none(xpath_text(vmap_data, './/MediaFile'))
        if video_url not in urls:
            fmts, subs = self._extract_variant_formats({'url': video_url}, video_id)
            formats.extend(fmts)
            subtitles = self._merge_subtitles(subtitles, subs)
        return formats, subtitles

    @staticmethod
    def _search_dimensions_in_video_url(a_format, video_url):
        m = re.search(r'/(?P<width>\d+)x(?P<height>\d+)/', video_url)
        if m:
            a_format.update({
                'width': int(m.group('width')),
                'height': int(m.group('height')),
            })

    def is_logged_in(self):
        return bool(self._get_cookies(self._API_BASE).get('auth_token'))

    def _call_api(self, path, video_id, query={}, graphql=False):
        cookies = self._get_cookies(self._API_BASE)
        base_headers = {}

        csrf_cookie = cookies.get('ct0')
        if csrf_cookie:
            base_headers['x-csrf-token'] = csrf_cookie.value

        is_logged_in = self.is_logged_in()
        if is_logged_in:
            base_headers.update({
                'x-twitter-auth-type': 'OAuth2Session',
                'x-twitter-client-language': 'en',
                'x-twitter-active-user': 'yes',
            })

        error = None
        result = None
        for bearer_token in self._TOKENS:
            headers = base_headers.copy()
            headers['Authorization'] = f'Bearer {bearer_token}'

            if not is_logged_in:
                if not self._TOKENS[bearer_token]:
                    guest_token_response = self._download_json(
                        self._API_BASE + 'guest/activate.json', video_id,
                        'Downloading guest token', data=b'', headers=headers)

                    guest_token = guest_token_response.get('guest_token')
                    if not guest_token:
                        raise ExtractorError('Could not retrieve guest token')


Review comment (security):
```suggestion
        cookies = self._get_cookies(self._API_BASE)
        headers = {}

        csrf_cookie = cookies.get('ct0')
        if csrf_cookie:
            headers['x-csrf-token'] = csrf_cookie.value
```

Code after:
            formats.extend(fmts)
            subtitles = self._merge_subtitles(subtitles, subs)
        video_url = strip_or_none(xpath_text(vmap_data, './/MediaFile'))
        if video_url not in urls:
            fmts, subs = self._extract_variant_formats({'url': video_url}, video_id)
            formats.extend(fmts)
            subtitles = self._merge_subtitles(subtitles, subs)
        return formats, subtitles

    @staticmethod
    def _search_dimensions_in_video_url(a_format, video_url):
        m = re.search(r'/(?P<width>\d+)x(?P<height>\d+)/', video_url)
        if m:
            a_format.update({
                'width': int(m.group('width')),
                'height': int(m.group('height')),
            })

    @functools.cached_property
    def is_logged_in(self):
        return bool(self._get_cookies(self._API_BASE).get('auth_token'))

    def _call_api(self, path, video_id, query={}, graphql=False):
        cookies = self._get_cookies(self._API_BASE)
        headers = {}

        csrf_cookie = cookies.get('ct0')
        if csrf_cookie:
            headers['x-csrf-token'] = csrf_cookie.value

        if self.is_logged_in:
            headers.update({
                'x-twitter-auth-type': 'OAuth2Session',
                'x-twitter-client-language': 'en',
                'x-twitter-active-user': 'yes',
            })

        result, last_error = None, None
        for bearer_token in self._TOKENS:
            headers['Authorization'] = f'Bearer {bearer_token}'

            if not self.is_logged_in:
                if not self._TOKENS[bearer_token]:
                    headers.pop('x-guest-token', None)
                    guest_token_response = self._download_json(
                        self._API_BASE + 'guest/activate.json', video_id,
                        'Downloading guest token', data=b'', headers=headers)

                    self._TOKENS[bearer_token] = guest_token_response.get('guest_token')
                    if not self._TOKENS[bearer_token]:
                        raise ExtractorError('Could not retrieve guest token')