Endpoint appears to be broken

[joshuatz]

Trying to add item via AJAX seems to have broken; my guess is the endpoint changed or the named params change. Need to look into this and fix.

[joshuatz]

Update: after some digging, it has become apparent that they have started locking down the endpoints with extra controls. For example, the main AJAX endpoint is now checking the Origin header, and has obviously whitelisted their own "Amazon Assistant" domains, including "https://horizonte.browserapps.amazon.com" (and https://horizonte.browserapps.amazon.com/atwl), and are not "wildcarding" the CORS Access-Control-Allow-Origin header.

Two requests made from Postman, with all headers and data identical except for the Origin header, proved this pretty unequivocally.

Since the request need to pass credentials (e.g. the signed-in cookie), I can't proxy the request through CORS-anywhere, or any other custom proxy. And spoofing the origin is not a good idea for several reasons, starting with it being flat-out not possible with a vanilla installation of Chrome and no tweaking.

At this point, it seems this is probably not going to be possible to get around. Amazon seems really determined to kill off third-party product integrations (I also noticed that they got around to removing some random pages that mentioned the old Universal Add To Wishlist features). If I have some more spare time, I might try to find another workaround, but I don't have high hopes and might just archive this repo...

[joshuatz]

After a little more digging, it does indeed appear as though this is going to be the final "nail in the coffin" for adding non-Amazon items to an Amazon wishlist, other than using the official Amazon Assistant extension. With all the old endpoints deprecated, and the only remaining functional endpoint I could find locked down by origin, and without an API, I can't see a way forward on this.

Summary of what I found:

Killed off pages:

• Vendor button: amazon.com/wishlist/vendor-button/
• Static-add (was used by things like AddThis) - amazon.com/gp/wishlist/static-add
  • The webpage is still up, but submitting the form does nothing
• Regular add form - amazon.com/gp/wishlist/add
  • Still up, but submitting the form does nothing
• The original Universal Wishlist Button
  • Original URL (now redirects to assistant) - amazon.com/wishlist/universal
  • Help page (still up, but link redirects to assistant)
• iPad specific version is still up, but submits to the broken wishlist/add endpoint. - amazon.com/wishlist/ipad-install-2

Moving foward:

I will likely place this repo into "archive mode", update the README to reflect the status, and update my project page on my website to reflect this.

[LoganDark]

If there is any way to make this work - such as via Postman - then I would prefer it over installing Amazon's spyware on my computer. Is there any successor to this bookmarklet or any resources you can provide to make it possible to add external links to a wishlist by any means other than by using their extension?

Edit: I was able to create a separate browser profile just to contain the extension.

[joshuatz]

@LoganDark It definitely should be possible to do this from outside the browser (because then you can spoof origin easily), but it would be a pretty big pain - you would need to reverse-engineer the Amazon extension, pass around a cookie string for credentials, and probably a few other things I'm not thinking of. The last time I researched this (a few years ago), nothing had changed and I couldn't find any workarounds or easier approaches.

I'm still annoyed about this to this day (I'm not a fan of browser spyware either!)

EDIT: I suppose if I had to do this over today, I would probably rewrite this as a CLI instead of a browser extension. You could even pass the auth token / cookie from the browser to the CLI and persist it for as long as possible. Still would be a good chunk of work to rewrite all this and workaround Amazon's restrictions.

Edit: I was able to create a separate browser profile just to contain the extension.

Smart thinking!

[mjsir911]

I have been able to successfully reverse engineer the add to wishlist flow here:

https://gist.github.com/mjsir911/a3bc9bb23775158e240dc56a9717f9f7

[LoganDark]

I have been able to successfully reverse engineer the add to wishlist flow here:

https://gist.github.com/mjsir911/a3bc9bb23775158e240dc56a9717f9f7

Thank you so much!

[joshuatz]

I have been able to successfully reverse engineer the add to wishlist flow here:

https://gist.github.com/mjsir911/a3bc9bb23775158e240dc56a9717f9f7

Nice work!