Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/vrt.py (Python)

Code before:
        if self._get_login_info()[0]:
            access_token, video_token = self.cache.load(self._NETRC_MACHINE, 'token_data', default=(None, None))

            if (access_token and not self._is_jwt_token_expired(access_token)
                    and video_token and not self._is_jwt_token_expired(video_token)):
                self.write_debug('Restored tokens from cache')
                self._set_cookie('.vrt.be', self._ACCESS_TOKEN_COOKIE_NAME, access_token)
                self._set_cookie('.vrt.be', self._VIDEO_TOKEN_COOKIE_NAME, video_token)
                return access_token, video_token

        if not self._get_vrt_cookie(self._REFRESH_TOKEN_COOKIE_NAME):
            return None, None

        self._request_webpage(
            'https://www.vrt.be/vrtmax/sso/refresh', None,
            note='Refreshing tokens', errnote='Failed to refresh tokens', fatal=False)

        access_token = self._get_vrt_cookie(self._ACCESS_TOKEN_COOKIE_NAME)
        video_token = self._get_vrt_cookie(self._VIDEO_TOKEN_COOKIE_NAME)

        if not access_token or not video_token:
            self.cache.store(self._NETRC_MACHINE, 'refresh_token', None)
            self.report_warning('Refreshing of tokens failed')
            return None, None

        if self._get_login_info()[0]:
            self.cache.store(self._NETRC_MACHINE, 'token_data', (access_token, video_token))

        return access_token, video_token

    def _get_vrt_cookie(self, cookie_name):
        return try_call(lambda: self._get_cookies('https://www.vrt.be/vrtmax/sso')[cookie_name].value)

    @staticmethod
    def _is_jwt_token_expired(token):
        return jwt_decode_hs256(token)['exp'] - time.time() < 300

    def _perform_login(self, username, password):
        refresh_token = self._get_vrt_cookie(self._REFRESH_TOKEN_COOKIE_NAME)
        if refresh_token and not self._is_jwt_token_expired(refresh_token):
            self.write_debug('Refresh token already present')
            return

        refresh_token = self.cache.load(self._NETRC_MACHINE, 'refresh_token', default=None)
        if refresh_token and not self._is_jwt_token_expired(refresh_token):
            self.write_debug('Restored refresh token from cache')
            self._set_cookie('.www.vrt.be', self._REFRESH_TOKEN_COOKIE_NAME, refresh_token, path='/vrtmax/sso')
            return

        self._request_webpage(
            'https://www.vrt.be/vrtmax/sso/login', None,

Review comment (security):
```suggestion
        if has_credentials:
```

or if using my re-login suggestion above, then:

```suggestion
        elif has_credentials:
```
so we don't unnecessarily cache to disk twice

Code after:
        video_token = self._get_vrt_cookie(self._VIDEO_TOKEN_COOKIE_NAME)

        if (access_token and not self._is_jwt_token_expired(access_token)
                and video_token and not self._is_jwt_token_expired(video_token)):
            return access_token, video_token

        if has_credentials:
            access_token, video_token = self.cache.load(self._NETRC_MACHINE, 'token_data', default=(None, None))

            if (access_token and not self._is_jwt_token_expired(access_token)
                    and video_token and not self._is_jwt_token_expired(video_token)):
                self.write_debug('Restored tokens from cache')
                self._set_cookie(self._TOKEN_COOKIE_DOMAIN, self._ACCESS_TOKEN_COOKIE_NAME, access_token)
                self._set_cookie(self._TOKEN_COOKIE_DOMAIN, self._VIDEO_TOKEN_COOKIE_NAME, video_token)
                return access_token, video_token

        if not self._get_vrt_cookie(self._REFRESH_TOKEN_COOKIE_NAME):
            return None, None

        self._request_webpage(
            'https://www.vrt.be/vrtmax/sso/refresh', None,
            note='Refreshing tokens', errnote='Failed to refresh tokens', fatal=False)

        access_token = self._get_vrt_cookie(self._ACCESS_TOKEN_COOKIE_NAME)
        video_token = self._get_vrt_cookie(self._VIDEO_TOKEN_COOKIE_NAME)

        if not access_token or not video_token:
            self.cache.store(self._NETRC_MACHINE, 'refresh_token', None)
            self.cookiejar.clear(self._TOKEN_COOKIE_DOMAIN, '/vrtmax/sso', self._REFRESH_TOKEN_COOKIE_NAME)
            msg = 'Refreshing of tokens failed'
            if not has_credentials:
                self.report_warning(msg)
                return None, None
            self.report_warning(f'{msg}. Re-logging in')
            return self._perform_login(*self._get_login_info())

        if has_credentials:
            self.cache.store(self._NETRC_MACHINE, 'token_data', (access_token, video_token))

        return access_token, video_token

    def _get_vrt_cookie(self, cookie_name):
        # Refresh token cookie is scoped to /vrtmax/sso, others are scoped to /
        return try_call(lambda: self._get_cookies('https://www.vrt.be/vrtmax/sso')[cookie_name].value)

    @staticmethod
    def _is_jwt_token_expired(token):
        return jwt_decode_hs256(token)['exp'] - time.time() < 300

    def _perform_login(self, username, password):
        refresh_token = self._get_vrt_cookie(self._REFRESH_TOKEN_COOKIE_NAME)