Unauthorized even though curl works

Following my comment on your PR, here’s my current problem

Running

import qbittorrentapi

# instantiate a Client using the appropriate WebUI configuration
qbt_client = qbittorrentapi.Client(host='https://qbittorrent.DOMAIN.TLD', port=443, username='USER', password='PASS')

# the Client will automatically acquire/maintain a logged in state in line with any request.
# therefore, this is not necessary; however, you may want to test the provided login credentials.
try:
    qbt_client.auth_log_in()
except qbittorrentapi.LoginFailed as e:
    print(e)

# display qBittorrent info
print(f'qBittorrent: {qbt_client.app.version}')
print(f'qBittorrent Web API: {qbt_client.app.web_api_version}')
for k,v in qbt_client.app.build_info.items(): print(f'{k}: {v}')

# retrieve and show all torrents
for torrent in qbt_client.torrents_info():
    print(f'{torrent.hash[-6:]}: {torrent.name} ({torrent.state})')

gives me a

/home/seluj78/Pytorr/.venv/lib/python3.8/site-packages/urllib3/connectionpool.py:1013: InsecureRequestWarning: Unverified HTTPS request is being made to host 'qbittorrent.seluj78.fr'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
  warnings.warn(
Traceback (most recent call last):
  File "/home/seluj78/Pytorr/test_qbittorrent_api.py", line 9, in <module>
    qbt_client.auth_log_in()
  File "/home/seluj78/Pytorr/.venv/lib/python3.8/site-packages/qbittorrentapi/auth.py", line 92, in auth_log_in
    self._post(
  File "/home/seluj78/Pytorr/.venv/lib/python3.8/site-packages/qbittorrentapi/request.py", line 212, in _post
    return self._request_manager(
  File "/home/seluj78/Pytorr/.venv/lib/python3.8/site-packages/qbittorrentapi/request.py", line 258, in _request_manager
    return self._request(**kwargs)
  File "/home/seluj78/Pytorr/.venv/lib/python3.8/site-packages/qbittorrentapi/request.py", line 290, in _request
    self.handle_error_responses(params=params, response=response)
  File "/home/seluj78/Pytorr/.venv/lib/python3.8/site-packages/qbittorrentapi/request.py", line 542, in handle_error_responses
    raise Unauthorized401Error(response.text)
qbittorrentapi.exceptions.Unauthorized401Error: Unauthorized

Process finished with exit code 1

while running

curl -v -d "username=USER&password=PASS" -X POST https://qbittorrent.DOMAIN.TLD/api/v2/auth/login

returns

Note: Unnecessary use of -X or --request, POST is already inferred.
*   Trying 62.212.90.183:443...
* TCP_NODELAY set
* Connected to qbittorrent.DOMAIN.TLD (62.212.90.183) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use h2
* Server certificate:
*  subject: CN=qbittorrent.DOMAIN.TLD
*  start date: Oct 27 04:40:42 2021 GMT
*  expire date: Jan 25 04:40:41 2022 GMT
*  subjectAltName: host "qbittorrent.DOMAIN.TLD" matched cert's "qbittorrent.DOMAIN.TLD"
*  issuer: C=US; O=Let's Encrypt; CN=R3
*  SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x5609d5161e10)
> POST /api/v2/auth/login HTTP/2
> Host: qbittorrent.DOMAIN.TLD
> user-agent: curl/7.68.0
> accept: */*
> content-length: 38
> content-type: application/x-www-form-urlencoded
> 
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* Connection state changed (MAX_CONCURRENT_STREAMS == 250)!
* We are completely uploaded and fine
< HTTP/2 200 
< content-security-policy: default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; object-src 'none'; form-action 'self'; frame-ancestors 'self';
< content-type: text/plain; charset=UTF-8
< date: Wed, 03 Nov 2021 15:57:29 GMT
< referrer-policy: same-origin
< set-cookie: SID=XXXX; HttpOnly; path=/; SameSite=Strict
< x-content-type-options: nosniff
< x-frame-options: SAMEORIGIN
< x-xss-protection: 1; mode=block
< content-length: 3
< 
* Connection #0 to host qbittorrent.DOMAIN.TLD left intact

Any clue ?

[rmartin16]

Ahhhh…this is great. Thank you @w1ldg00se.

An initial thought is that qBittorrent’s CSRF check is too naive since it is simply doing a blind comparison of ports between the target URL and origin URL. An HTTPS URL without a port implies port 443…therefore, it seems reasonable for qBittorrent’s check to incorporate this well-established standard.

OTOH, this check is frustrating in general for API use outside of the actual WebUI…after all, these Headers will always be spoofed because this client isn’t a browser. Given qBittorrent (at least now) doesn’t even perform CSRF checks if the Origin and Referer headers are absent from requests, I’m particularly inclined to stop populating them in requests from this client.

I’ll do some more testing (especially with older qBittorrent versions) and report back additional thoughts.

Thanks again.

[Seluj78]

You’re welcome, thanks for the fix ! 🎉