Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/twitter.py (Python)

Code before:
            })

    def is_logged_in(self):
        return bool(self._get_cookies(self._API_BASE).get('auth_token'))

    def _call_api(self, path, video_id, query={}, graphql=False):
        cookies = self._get_cookies(self._API_BASE)
        base_headers = {}

        csrf_cookie = cookies.get('ct0')
        if csrf_cookie:
            base_headers['x-csrf-token'] = csrf_cookie.value

        is_logged_in = self.is_logged_in()
        if is_logged_in:
            base_headers.update({
                'x-twitter-auth-type': 'OAuth2Session',
                'x-twitter-client-language': 'en',
                'x-twitter-active-user': 'yes',
            })

        error = None
        result = None
        for bearer_token in self._TOKENS:
            headers = base_headers.copy()
            headers['Authorization'] = f'Bearer {bearer_token}'

            if not is_logged_in:
                if not self._TOKENS[bearer_token]:
                    guest_token_response = self._download_json(
                        self._API_BASE + 'guest/activate.json', video_id,
                        'Downloading guest token', data=b'', headers=headers)

                    guest_token = guest_token_response.get('guest_token')
                    if not guest_token:
                        raise ExtractorError('Could not retrieve guest token')

                    self._TOKENS[bearer_token] = guest_token
                headers['x-guest-token'] = self._TOKENS[bearer_token]

            try:
                allowed_status = {400, 403, 404} if graphql else {403}
                result = self._download_json(
                    (self._GRAPHQL_API_BASE if graphql else self._API_BASE) + path,
                    video_id, headers=headers, query=query, expected_status=allowed_status)
                break

            except ExtractorError as e:
                if error:
                    raise error


Review comment (security):
```suggestion
            headers['Authorization'] = f'Bearer {bearer_token}'
```

Code after:
                'width': int(m.group('width')),
                'height': int(m.group('height')),
            })

    @functools.cached_property
    def is_logged_in(self):
        return bool(self._get_cookies(self._API_BASE).get('auth_token'))

    def _call_api(self, path, video_id, query={}, graphql=False):
        cookies = self._get_cookies(self._API_BASE)
        headers = {}

        csrf_cookie = cookies.get('ct0')
        if csrf_cookie:
            headers['x-csrf-token'] = csrf_cookie.value

        if self.is_logged_in:
            headers.update({
                'x-twitter-auth-type': 'OAuth2Session',
                'x-twitter-client-language': 'en',
                'x-twitter-active-user': 'yes',
            })

        result, last_error = None, None
        for bearer_token in self._TOKENS:
            headers['Authorization'] = f'Bearer {bearer_token}'

            if not self.is_logged_in:
                if not self._TOKENS[bearer_token]:
                    headers.pop('x-guest-token', None)
                    guest_token_response = self._download_json(
                        self._API_BASE + 'guest/activate.json', video_id,
                        'Downloading guest token', data=b'', headers=headers)

                    self._TOKENS[bearer_token] = guest_token_response.get('guest_token')
                    if not self._TOKENS[bearer_token]:
                        raise ExtractorError('Could not retrieve guest token')
                headers['x-guest-token'] = self._TOKENS[bearer_token]

            try:
                allowed_status = {400, 403, 404} if graphql else {403}
                result = self._download_json(
                    (self._GRAPHQL_API_BASE if graphql else self._API_BASE) + path,
                    video_id, headers=headers, query=query, expected_status=allowed_status)
                break

            except ExtractorError as e:
                if last_error:
                    raise last_error
                elif not isinstance(e.cause, urllib.error.HTTPError) or e.cause.code != 404:
                    raise