Unable to retrieve anything from Duolingo ...

[swa72]

What used to work, now shows ...

[JASchilz]

Thanks for reporting this! I confirm that I get the same. I'll have to get back to this on Sunday.

…

On Sat, Feb 18, 2023 at 2:58 AM swa72 ***@***.***> wrote: What used to work, now shows ... [image: 2023-02-18 11_56_31-] <https://user-images.githubusercontent.com/17599763/219856637-91c08393-4dd4-475c-896e-c52160cc0410.png> — Reply to this email directly, view it on GitHub <#64>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABO2Q4HLOMGO5BCE2F7I2SLWYCTMFANCNFSM6AAAAAAVAJACQY> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[JASchilz]

OK. It looks like something has changed in Duolingo which has broken this plugin. They may have added some extra security that rejects requests that aren't coming from their own web page or mobile apps.

This plugin uses a third party code library to interact with Duolingo, and other users of that library are reporting similar issues which started in the last couple of days in the following issue KartikTalwar/Duolingo#128 .

Right now it's not clear if:

1. this is a small, incidental change by Duolingo
2. or if it's maybe a change to deliberately stop people who are trying to interact with Duolingo outside of their own web page and mobile apps.

I'm going to investigate more today. If it's case (1) then I might be able to make a fix. If it's (2) then our days of AnkiSyncDuolingo might be at an end. :( In either case, thanks for bringing up this issue and if I can't fix it then I'll prominently post that in the description of the plugin.

[jameskraus]

I think this can be worked around. First, I don't think this layer of security is actually doing anything at the moment. I was able to successfully submit this as a request and get a valid JWT back:

POST /2017-06-30/login?fields= HTTP/1.1
Accept: application/json, */*;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Length: 102
Content-Type: application/json
Host: www.duolingo.com
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36

{
    "identifier": "my@email.com",
    "password": "<my-password>",
    "signal": {
        "token": "-",
        "vendor": 2
    }
}

The user-agent header appeared to be required, so I just used the one from my browser. I also found the above was the minimal input I could use and still get a valid JWT at the end.

I'm not entirely sure this is replicable though. I attempted to hack it into the add on, but I didn't have success and experienced an opaque error message. Maybe I just did something wrong, maybe my experiments with cURL don't translate to python requests, or maybe there's just gremlins in the code.

Long term, it also appears scraping the credentials from a login is a viable route. There's a few different ways to make it easier to grab a JWT from a given Duolingo session so we can make the request. Here's some rough ideas:

• Create a Chrome extension specifically for grabbing the JWT from an active Duolingo session
• Embed a QWebBrowser and scrape a JWT out of that after the user logs in

I would recommend the second approach, since it's pretty natural to log into Duolingo for end users and would be resilient against further changes to the login API. Obviously more work that just pasting in a JWT though.

@JASchilz: Could you try the above request format and see if it works for you?

[jameskraus]

@JASchilz, I opened a PR which allows for inputting the JWT instead of a password: #65. If the workaround in my above message doesn't work for you, then maybe this is a potential route forward. The copy is pretty poor / technical, so would obviously need tweaking on instructions.

[JASchilz]

Got it, James. I'm definitely interested in looking at these possibilities, and the idea of an embedded web browser seems like it could work and the idea is appreciated:) I'll give it a try. Because it might take a while to get things working, I'll put a notice on the plugin that it's temporarily out of commission.

…

On Mon, Feb 20, 2023 at 6:05 PM James Kraus ***@***.***> wrote: @JASchilz <https://github.com/JASchilz>, I opened a PR which allows for inputting the JWT instead of a password: #65 <#65>. If the workaround in my above message doesn't work for you, then maybe this is a potential route forward. The copy is pretty poor, so would obviously tweaking on instructions. — Reply to this email directly, view it on GitHub <#64 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABO2Q4C6GEKVLSZEE3ECJHTWYQPHZANCNFSM6AAAAAAVAJACQY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[jameskraus]

@JASchilz: I opened a proof of concept PR which authenticates with an embedded QWebEngineView. It would need polish around the edges (refactoring, instructions for users, etc) but demonstrates the general idea. See #66

[JASchilz]

Hi folks including @swa72 ! I've created a release candidate from @jameskraus's pull request, which beautifully addresses this problem on my own machine.

You can install the plugin manually from https://github.com/JASchilz/AnkiSyncDuolingo/releases/tag/2.1.0rc1 . I'll make a couple of additional help/documentation changes and perform a full release on the Anki site within the next week.

[Exkywor]

I tried 2.1.0rc1, but it doesn't seem to be working for accounts created with Google.
I tried logging in with a password, but then Duolingo says my account was created with Google, so I click on "Continue with Google", and... nothing happens. If, on the other hand, instead of trying to log in with a password I click on "Google", it says "We’re having trouble connecting. Please try again later.".

[JASchilz]

Hi @Exkywor , thanks for trying this out and letting me know.

I tried logging in with a password

To confirm, is it the case that you've created a password with Duolingo (separate from your Google account credentials) and the site is telling you to log in with Google?

If you haven't, could you try creating a password at https://www.duolingo.com/settings/password and logging in with that?

[JASchilz]

OK! I've published a new released on Ankiweb from the embedded-auth branch. I added a minimum of documentation/warnings to let users know that they have to log in with their Duolingo credentials and that they might encounter problems.

I did confirm that I also wasn't able to log in using Google, like @Exkywor, but I'm still curious to know if you found a way to log in with Duolingo username/password.

Over the next week or so, I'm going to clean things up like some orphan code and an error message that you get if you close the log in browser. Thanks again to everyone reporting the issue and @jameskraus for providing a solution.

I'll keep this issue open until I'm sure that we have a clean log in path for all users.

[Exkywor]

To confirm, is it the case that you've created a password with Duolingo (separate from your Google account credentials) and the site is telling you to log in with Google?

That is the case, yeah. I created my account with Google, and later added a password, with which I tried logging in, which is when it told me that my account was created with Google.
However, I tried again today just in case, and it seems to have gone through without issues?

[jameskraus]

This may be an artifact of Duolingo’s login process. My rough understanding is if an account exists, has SSO, and logging in fails, then it attempts to get you to log in with SSO. My weird experience with this was while developing the embedded auth prototype. I accidentally wrote an infinite loop and must have triggered some rate limiting in Duolingo. For the next day, logging in would fail and it would tell me to log in with Google, but that was also rate limited. Anyways, in summary, I think the auth mechanism for Duolingo is a little funky since it doesn’t appear to be aware of some failure conditions (e.g. rate limiting) and treats these as if you need to log in some different way (e.g. Google SSO).

…

On Tue, Mar 7, 2023 at 12:03 AM Fernando Quant ***@***.***> wrote: To confirm, is it the case that you've created a password with Duolingo (separate from your Google account credentials) and the site is telling you to log in with Google? That is the case, yeah. I created my account with Google, then I tried logging in and it told me it was created with Google. However, I tried again today just in case, and it seems to have gone through without issues? — Reply to this email directly, view it on GitHub <#64 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AADFKUKOAJSNYADPNG4VMPLW226TNANCNFSM6AAAAAAVAJACQY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[swa72]

While login now works thanks to the fix ... can anyone confirm that you can pull new vocabulary? I've recently finished one and started another section. Yet, the add-on reports no new vocabulary to pull.

[JASchilz]

Hi @swa72 ! I confirm that I'm able to pull new vocabulary in the sense of:

• I've got an Anki profile that I use just for testing this plugin.
• When I delete all of the cards that I've imported into that plugin, and re-run the plugin.
• It pulls down all of my existing cards.

So it works in that sense, but I haven't studied anything new and then imported that using the plugin, as I'm not currently studying with Duolingo.

Let us know if this helps you diagnose your case, or leaves open some questions. And as always, the plugin will import from the language that you most recently had open on the Duolingo site.

[swa72]

Ok, have to correct myself. Having completed yet another section, it did pull down new vocabulary. No idea, why it didn't before ;-) Thanks for your effort.

[potchy]

Confirmed that it's not working with accounts created via Facebook even if you have a proper password set-up.