Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/instagram.py (Python)

Code before:
        api_check = self._download_json(
            f'{self._API_BASE_URL}/web/get_ruling_for_content/?content_type=MEDIA&target_id={_id_to_pk(video_id)}',
            video_id, headers=self._API_HEADERS, fatal=False, note='Setting up session', errnote=False) or {}
        csrf_token = self._get_cookies('https://www.instagram.com').get('csrftoken')

        if not csrf_token:
            self.report_warning('No csrf token set by Instagram API', video_id)
            csrf_token = ''
        else:
            csrf_token = csrf_token.value if api_check.get('status') == 'ok' else None
            if not csrf_token:
                self.report_warning('Instagram API is not granting access', video_id)
                csrf_token = ''

        variables = {
            'shortcode': video_id,
            'child_comment_count': 3,
            'fetch_comment_count': 40,
            'parent_comment_count': 24,
            'has_threaded_comments': True,
        }
        general_info = self._download_json(
            'https://www.instagram.com/graphql/query/', video_id, fatal=False, errnote=False,
            headers={
                **self._API_HEADERS,
                'X-CSRFToken': csrf_token,
                'X-Requested-With': 'XMLHttpRequest',
                'Referer': url,
            }, query={
                'query_hash': '9f8827793ef34641b2fb195d4d41151c',
                'variables': json.dumps(variables, separators=(',', ':')),
            })
        media.update(traverse_obj(general_info, ('data', 'shortcode_media')) or {})

        if not general_info:
            self.report_warning('General metadata extraction failed (some metadata might be missing).', video_id)
            webpage, urlh = self._download_webpage_handle(url, video_id)
            shared_data = self._search_json(
                r'window\._sharedData\s*=', webpage, 'shared data', video_id, fatal=False) or {}

            if shared_data and self._LOGIN_URL not in urlh.geturl():
                media.update(traverse_obj(
                    shared_data, ('entry_data', 'PostPage', 0, 'graphql', 'shortcode_media'),
                    ('entry_data', 'PostPage', 0, 'media'), expected_type=dict) or {})
            else:
                self.report_warning('Main webpage is locked behind the login page. Retrying with embed webpage (some metadata might be missing).')
                webpage = self._download_webpage(
                    f'{url}/embed/', video_id, note='Downloading embed webpage', fatal=False)
                additional_data = self._search_json(
                    r'window\.__additionalDataLoaded\s*\(\s*[^,]+,\s*', webpage, 'additional data', video_id, fatal=False)
                if not additional_data and not media:

Review comment (security):
```suggestion
                'X-CSRFToken': csrf_token or '',
```

Code after:
        api_check = self._download_json(
            f'{self._API_BASE_URL}/web/get_ruling_for_content/?content_type=MEDIA&target_id={_id_to_pk(video_id)}',
            video_id, headers=self._API_HEADERS, fatal=False, note='Setting up session', errnote=False) or {}
        csrf_token = self._get_cookies('https://www.instagram.com').get('csrftoken')

        if not csrf_token:
            self.report_warning('No csrf token set by Instagram API', video_id)
        else:
            csrf_token = csrf_token.value if api_check.get('status') == 'ok' else None
            if not csrf_token:
                self.report_warning('Instagram API is not granting access', video_id)

        variables = {
            'shortcode': video_id,
            'child_comment_count': 3,
            'fetch_comment_count': 40,
            'parent_comment_count': 24,
            'has_threaded_comments': True,
        }
        general_info = self._download_json(
            'https://www.instagram.com/graphql/query/', video_id, fatal=False, errnote=False,
            headers={
                **self._API_HEADERS,
                'X-CSRFToken': csrf_token or '',
                'X-Requested-With': 'XMLHttpRequest',
                'Referer': url,
            }, query={
                'query_hash': '9f8827793ef34641b2fb195d4d41151c',
                'variables': json.dumps(variables, separators=(',', ':')),
            })
        media.update(traverse_obj(general_info, ('data', 'shortcode_media')) or {})

        if not general_info:
            self.report_warning('General metadata extraction failed (some metadata might be missing).', video_id)
            webpage, urlh = self._download_webpage_handle(url, video_id)
            shared_data = self._search_json(
                r'window\._sharedData\s*=', webpage, 'shared data', video_id, fatal=False) or {}

            if shared_data and self._LOGIN_URL not in urlh.geturl():
                media.update(traverse_obj(
                    shared_data, ('entry_data', 'PostPage', 0, 'graphql', 'shortcode_media'),
                    ('entry_data', 'PostPage', 0, 'media'), expected_type=dict) or {})
            else:
                self.report_warning('Main webpage is locked behind the login page. Retrying with embed webpage (some metadata might be missing).')
                webpage = self._download_webpage(
                    f'{url}/embed/', video_id, note='Downloading embed webpage', fatal=False)
                additional_data = self._search_json(
                    r'window\.__additionalDataLoaded\s*\(\s*[^,]+,\s*', webpage, 'additional data', video_id, fatal=False)
                if not additional_data and not media:
                    self.raise_login_required('Requested content is not available, rate-limit reached or login required')