Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/canvas.py (Python)

Code before:

        auth_info = self._download_json(
            'https://accounts.vrt.be/accounts.login', None,
            note='Login data', errnote='Could not get Login data',
            headers={}, data=urlencode_postdata({
                'loginID': username,
                'password': password,
                'sessionExpiration': '-2',
                'APIKey': self._APIKEY,
                'targetEnv': 'jssdk',
            }))

        # Sometimes authentication fails for no good reason, retry
        login_attempt = 1
        while login_attempt <= 3:
            try:
                self._request_webpage('https://token.vrt.be/vrtnuinitlogin',
                                      None, note='Requesting XSRF Token', errnote='Could not get XSRF Token',
                                      query={'provider': 'site', 'destination': 'https://www.vrt.be/vrtnu/'})

                post_data = {
                    'UID': auth_info['UID'],
                    'UIDSignature': auth_info['UIDSignature'],
                    'signatureTimestamp': auth_info['signatureTimestamp'],
                    'client_id': 'vrtnu-site',
                    '_csrf': self._get_cookies('https://token.vrt.be').get('OIDCXSRF').value,
                }

                self._request_webpage(
                    'https://login.vrt.be/perform_login',
                    None, note='Requesting a token', errnote='Could not get a token',
                    headers={}, data=urlencode_postdata(post_data))

            except ExtractorError as e:
                if isinstance(e.cause, compat_HTTPError) and e.cause.code == 401:
                    login_attempt += 1
                    self.report_warning('Authentication failed')
                    self._sleep(1, None, msg_template='Waiting for %(timeout)s seconds before trying again')
                else:
                    raise e
            else:
                break

    def _real_extract(self, url):
        display_id = self._match_id(url)

        webpage = self._download_webpage(url, display_id)

        attrs = extract_attributes(self._search_regex(
            r'(<nui-media[^>]+>)', webpage, 'media element'))
        video_id = attrs['videoid']

Review comment (security):
```suggestion
                    '_csrf': self._get_cookies('https://login.vrt.be').get('OIDCXSRF').value,
```

Code after:

        auth_info = self._download_json(
            'https://accounts.vrt.be/accounts.login', None,
            note='Login data', errnote='Could not get Login data',
            headers={}, data=urlencode_postdata({
                'loginID': username,
                'password': password,
                'sessionExpiration': '-2',
                'APIKey': self._APIKEY,
                'targetEnv': 'jssdk',
            }))

        # Sometimes authentication fails for no good reason, retry
        login_attempt = 1
        while login_attempt <= 3:
            try:
                self._request_webpage('https://token.vrt.be/vrtnuinitlogin',
                                      None, note='Requesting XSRF Token', errnote='Could not get XSRF Token',
                                      query={'provider': 'site', 'destination': 'https://www.vrt.be/vrtnu/'})

                post_data = {
                    'UID': auth_info['UID'],
                    'UIDSignature': auth_info['UIDSignature'],
                    'signatureTimestamp': auth_info['signatureTimestamp'],
                    'client_id': 'vrtnu-site',
                    '_csrf': self._get_cookies('https://login.vrt.be').get('OIDCXSRF').value,
                }

                self._request_webpage(
                    'https://login.vrt.be/perform_login',
                    None, note='Requesting a token', errnote='Could not get a token',
                    headers={}, data=urlencode_postdata(post_data))

            except ExtractorError as e:
                if isinstance(e.cause, compat_HTTPError) and e.cause.code == 401:
                    login_attempt += 1
                    self.report_warning('Authentication failed')
                    self._sleep(1, None, msg_template='Waiting for %(timeout)s seconds before trying again')
                else:
                    raise e
            else:
                break

    def _real_extract(self, url):
        display_id = self._match_id(url)

        webpage = self._download_webpage(url, display_id)

        attrs = extract_attributes(self._search_regex(
            r'(<nui-media[^>]+>)', webpage, 'media element'))
        video_id = attrs['videoid']