Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/vrt.py (Python)

Code before:
            raise ExtractorError(f'Login failed: {login_data.get("errorMessage")}', expected=True)

        self._download_webpage(
            login_data['redirectUrl'], None,
            note='Getting access token', errnote='Failed to get access token')

        self.cache.store(
            self._NETRC_MACHINE, 'token_data', (
                self._get_vrt_cookie(self._ACCESS_TOKEN_COOKIE_NAME),
                self._get_vrt_cookie(self._VIDEO_TOKEN_COOKIE_NAME)))
        self.cache.store(self._NETRC_MACHINE, 'refresh_token', self._get_vrt_cookie(self._REFRESH_TOKEN_COOKIE_NAME))

    def _real_extract(self, url):
        display_id = self._match_id(url)
        access_token, video_token = self._fetch_tokens()

        metadata = self._download_json(
            f'https://www.vrt.be/vrtnu-api/graphql{"" if access_token else "/public"}/v1',
            display_id, 'Downloading asset JSON', 'Unable to download asset JSON',
            data=json.dumps({
                'operationName': 'VideoPage',
                'query': self._VIDEO_PAGE_QUERY,
                'variables': {'pageId': urllib.parse.urlparse(url).path},
            }).encode(),
            headers={
                'Authorization': f'Bearer {access_token}' if access_token else None,
                'Content-Type': 'application/json',
                'x-vrt-client-name': 'WEB',
                'x-vrt-client-version': '1.5.9',
                'x-vrt-zone': 'default',
            })['data']['page']

        video_id = metadata['player']['modes'][0]['streamId']

        try:
            streaming_info = self._call_api(video_id, 'vrtnu-web@PROD', id_token=video_token)
        except ExtractorError as e:
            if not video_token and isinstance(e.cause, HTTPError) and e.cause.status == 404:
                self.raise_login_required()
            raise

        formats, subtitles = self._extract_formats_and_subtitles(streaming_info, video_id)

        code = traverse_obj(streaming_info, ('code', {str}))
        if not formats and code:
            if code in ('CONTENT_AVAILABLE_ONLY_FOR_BE_RESIDENTS', 'CONTENT_AVAILABLE_ONLY_IN_BE', 'CONTENT_UNAVAILABLE_VIA_PROXY'):
                self.raise_geo_restricted()
            elif code in ('CONTENT_AVAILABLE_ONLY_FOR_BE_RESIDENTS_AND_EXPATS', 'CONTENT_IS_AGE_RESTRICTED', 'CONTENT_REQUIRES_AUTHENTICATION'):
                self.raise_login_required()
            else:
                raise ExtractorError(f'Unable to extract formats: {code}')

Review comment (security):
We don't want to send `Authorization: None`
```suggestion
            headers=filter_dict{
                'Authorization': f'Bearer {access_token}' if access_token else None,
```

Code after:
            note='Getting session cookies', errnote='Failed to get session cookies')

        login_data = self._download_json(
            'https://login.vrt.be/perform_login', None, data=json.dumps({
                'clientId': 'vrtnu-site',
                'loginID': username,
                'password': password,
            }).encode(), headers={
                'Content-Type': 'application/json',
                'Oidcxsrf': self._get_cookies('https://login.vrt.be')['OIDCXSRF'].value,
            }, note='Logging in', errnote='Login failed', expected_status=403)
        if login_data.get('errorCode'):
            raise ExtractorError(f'Login failed: {login_data.get("errorMessage")}', expected=True)

        self._request_webpage(
            login_data['redirectUrl'], None,
            note='Getting access token', errnote='Failed to get access token')

        access_token = self._get_vrt_cookie(self._ACCESS_TOKEN_COOKIE_NAME)
        video_token = self._get_vrt_cookie(self._VIDEO_TOKEN_COOKIE_NAME)
        refresh_token = self._get_vrt_cookie(self._REFRESH_TOKEN_COOKIE_NAME)

        if not all((access_token, video_token, refresh_token)):
            raise ExtractorError('Unable to extract token cookie values')

        self.cache.store(self._NETRC_MACHINE, 'token_data', (access_token, video_token))
        self.cache.store(self._NETRC_MACHINE, 'refresh_token', refresh_token)

        return access_token, video_token

    def _real_extract(self, url):
        display_id = self._match_id(url)
        access_token, video_token = self._fetch_tokens()

        metadata = self._download_json(
            f'https://www.vrt.be/vrtnu-api/graphql{"" if access_token else "/public"}/v1',
            display_id, 'Downloading asset JSON', 'Unable to download asset JSON',
            data=json.dumps({
                'operationName': 'VideoPage',
                'query': self._VIDEO_PAGE_QUERY,
                'variables': {'pageId': urllib.parse.urlparse(url).path},
            }).encode(),
            headers=filter_dict({
                'Authorization': f'Bearer {access_token}' if access_token else None,
                'Content-Type': 'application/json',
                'x-vrt-client-name': 'WEB',
                'x-vrt-client-version': '1.5.9',
                'x-vrt-zone': 'default',
            }))['data']['page']

        video_id = metadata['player']['modes'][0]['streamId']