Repository: yt-dlp/yt-dlp
File: yt_dlp/extractor/softwhiteunderbelly.py (Python)

Code before:
        },
    ]

    def _get_authenticity_token(self, display_id):
        signin_page = self._download_webpage(self._LOGIN_URL, display_id, note='Getting authenticity token')
        return self._html_search_regex(
            r'name=["\']authenticity_token["\'] value=["\'](.+?)["\']', signin_page, 'authenticity_token',
        )

    def _login(self, display_id):
        username, password = self._get_login_info()
        if not username:
            return True

        response = self._download_webpage(
            self._LOGIN_URL,
            display_id,
            note='Logging in',
            fatal=False,
            data=urlencode_postdata({
                'email': username,
                'password': password,
                'authenticity_token': self._get_authenticity_token(display_id),
                'utf8': True,
            }),
        )

        user_has_subscription = self._search_regex(
            r'user_has_subscription:\s*["\'](.+?)["\']', response, 'subscription status', default='none',
        )
        if user_has_subscription.lower() == 'true':
            return
        elif user_has_subscription.lower() == 'false':
            return 'Account is not subscribed'
        else:
            return 'Incorrect username/password'

    def _real_extract(self, url):
        display_id = self._match_id(url)

        webpage = None
        if self._get_cookies('https://www.softwhiteunderbelly.com').get('_session'):
            webpage = self._download_webpage(url, display_id)
        if not webpage or '<div id="watch-unauthorized"' in webpage:
            login_err = self._login(display_id)
            webpage = self._download_webpage(url, display_id)
            if login_err and '<div id="watch-unauthorized"' in webpage:
                if login_err is True:
                    self.raise_login_required(method='any')
                raise ExtractorError(login_err, expected=True)


Review comment (security):
I'd rather the POST request be fatal. If invalid user/pass gets an error response, we can try/except for the specific error status and raise an expected ExtractorError with an appropriate message
```suggestion
        login_page = self._download_webpage(self._LOGIN_URL, None, 'Fetching authenticity token')

        self._download_webpage(
            self._LOGIN_URL, None, 'Logging in',
            data=urlencode_postdata({
                'email': username,
                'password': password,
                'authenticity_token': self._html_search_regex(
                    r'name=["\']authenticity_token["\']\s+value=["\']([^"\']+)', login_page, 'authenticity token')
                'utf8': True,
            }))
```

Code after:
            self._LOGIN_URL, None, 'Logging in',
            data=urlencode_postdata({
                'email': username,
                'password': password,
                'authenticity_token': self._html_search_regex(
                    r'name=["\']authenticity_token["\']\s+value=["\']([^"\']+)', signin_page, 'authenticity_token'),
                'utf8': True,
            }),
        )

    def _real_extract(self, url):
        display_id = self._match_id(url)

        webpage = self._download_webpage(url, display_id)
        if '<div id="watch-unauthorized"' in webpage:
            if self._get_cookies('https://www.softwhiteunderbelly.com').get('_session'):
                raise ExtractorError('This account is not subscribed to this content', expected=True)
            self.raise_login_required()

        embed_url, embed_id = self._html_search_regex(
            r'embed_url:\s*["\'](?P<url>https?://embed\.vhx\.tv/videos/(?P<id>\d+)[^"\']*)',
            webpage, 'embed url', group=('url', 'id'))

        return {
            '_type': 'url_transparent',
            'ie_key': VHXEmbedIE.ie_key(),
            'url': VHXEmbedIE._smuggle_referrer(embed_url, 'https://www.softwhiteunderbelly.com'),
            'id': embed_id,
            'display_id': display_id,
            'title': traverse_obj(webpage, ({find_element(id='watch-info')}, {find_element(cls='video-title')}, {clean_html})),
            'description': self._html_search_meta('description', webpage, default=None),
            'thumbnail': update_url(self._og_search_thumbnail(webpage) or '', query=None) or None,
        }