fix: update oauth get token call for correctness #18
Conversation
Lash-L
changed the title
|
Seemingly good to me - we can ignore the commit lint warning as I can fix that during merge. Give me about ~10 minutes and I'll test it and merge |
|
For Commit message, maybe include some of @drysart's words?
|
* add an authorization header to specify the client id (base64 encoded value for ios_cgi_myq:) * add an accept header with / * remove the unnecessary client_id, client_secret, and scope form fields * added [0] to the line extracting the code form field to get the code as a string --------- Co-authored-by: Luke Lashley <conway220@gmail.com>
|
Thanks @drysart - if you want to make the PR to bump the version in Home Assistant too, feel free if you'd like it on your git history or anything. Otherwise I can do it in a little bit -stepping away from a computer for a bit. |
|
I performed the edit on the api.py file and that seems to start generating 403 errors but I am still getting the 429 error after the 403 errors accumulate. I restarted HA completely but NO change.
I also get this login screen that shows up IN MY LOG VIEWER.
|
|
@atombombzero MyQ has made additional changes to their API since the fix from this PR that have once again broken it. There's no additional fix available yet. |
Thanks. I was beating my head against this wondering why. I appreciate the input. I am a UNIX nerf herder by trade but the seven levels of inception in the HAOS dockers had me stuck for a bit. I got this far and hit this wall. I really appreciate the knowledge that this is NOT something that I can control. I have time and (limited) skills, so if there is anything that I can do that will help benefit myself and/or the community at large - teach me (what I don't know) and I will get as involved/deep as I can. |
|
@drysart this may be a newb question but here goes: is there a way to git updates to the add-on directly from the CLI without the HAOS GUI (uninstall/install)? |
|
Basically we need to figure out all of the correct parameters for the login requests I've done this in a few ways before for other apps
I am sure there are other ways, but I haven't had time to try anything further than just a basic mitm attack. But there are a lot of resources online if you would like to learn a new talent My understanding is when they originally Reverse Engineered the api, there was a web client you could use to connect to myq, but that does not exist anymore. |
|
You will need to defeat certificate pinning prior to any additional reverse engineering. That’s less and less easy as devices are getting more locked down over the years…but if someone has an older, compromised device, you can then MITM it. There’s also a tantalizing MQTT entry point built into myQ. Couldn’t get past it, but if someone with more time and creativity wants to go for it, it’s the better long-term vector, as it appears to have a pub/sub API which would alleviate all sorts of things in the current poll-based method we’re stuck with. Same issues with respect to pinning need to be dealt with there as well. That’s how the app tends to receive its telemetry. Enjoy. |
Yes, if you've got a basic knowledge of using the Linux command line, you can get a bash shell in the homeassistant docker image and update files in there yourself; and they'll persist until the next time your homeassistant image as a whole is updated. There are instructions for doing so in another issue related to the fix for today's breakage (the fix I mentioned we didn't have yet earlier in this thread -- we've got it now). |
See: home-assistant/core#101763
This PR updates the call to the OAuth get token endpoint to be more in line with the OAuth specs, to fix an issue where MyQ is returning 401 errors.
Please review pretty closely, I don't do a lot of coding in Python. ;)