unexpected response from Apple (HTTP 204): empty or non-plist body

[missaustraliana]

What happened?

Apple patched out 2.3.1.

Logging in and purchasing apps is no longer possible. The status codes seem to fluctuate in random. Below is some errors from when I tried to purchase an app

12:02PM ERR error="request failed: unexpected response from Apple (HTTP 403): 403 Forbidden 403 Forbidden Apple" success=false
12:02PM ERR error="request failed: unexpected response from Apple (HTTP 404): 404 Not Found 404 Not Found Apple" success=false
12:02PM ERR error="request failed: unexpected response from Apple (HTTP 301): 301 Moved Permanently 301 Moved Permanently Apple" success=false
12:02PM ERR error="request failed: unexpected response from Apple (HTTP 204): empty or non-plist body" success=false

Version

2.3.1

Relevant log output

ipatool auth login -e [email]
12:05PM INF enter password:
12:05PM ERR error="request failed: unexpected response from Apple (HTTP 204): empty or non-plist body" success=false

[yangliu-1995]

got same error

[martin-60896]

Change the login url to https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/authenticate. I won't ask why. Apple is just so inexplicable.

[missaustraliana]

Change the login url to https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/authenticate. I won't ask why. Apple is just so inexplicable.

thats the url already set in the latest version, but i tried it anyway to give the benefit of the doubt by building myself and same issue.

[martin-60896]

Change the login url to https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/authenticate. I won't ask why. Apple is just so inexplicable.

thats the url already set in the latest version, but i tried it anyway to give the benefit of the doubt by building myself and same issue.

The current login url is derived from the url returned by the bag request.appstore.BagInput(). To be precise, it is https://auth.itunes.apple.com/auth/v1/native/fast/. You can try hard-coding this address.

[Gautam010]

Has anyone been able to figure out a fix or workaround? Tried out the once mentioned on this thread

[bboy910225]

Hi, everyone I had product cause by this problem that I provide my solution.

I confirmed that the legacy authentication flow is working in my implementation.

The authentication endpoint returned by the Store bag was:

https://auth.itunes.apple.com/auth/v1/native/fast/
Posting to this endpoint returned HTTP 404 with no valid plist response.

I then retried using the legacy endpoint:

https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/authenticate
Apple returned:

HTTP 302
Location: https://p7-buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/authenticate?Pod=7&PRH=7

I repeated the POST request to the redirected URL, preserving the original plist body. Apple then returned HTTP 200 with a valid plist response.

native/fast/ → 404
legacy authenticate → 302
repeat POST to the pod URL → 200 + plist

I was then able to retrieve passwordToken, dsPersonId, Storefront, and the assigned pod. The authenticated Store session also worked for subsequent billing/storefront requests.

Important: do not let the HTTP client automatically convert the redirected POST request into a GET request. Repeat the POST request to the URL from the Location header with the original plist body.

[bboy910225]

I prepared a tested patch for this flow:

• native /auth/v1/native/fast gets an empty/non-plist 204, 403, 404, or 503
• retry legacy https://buy.itunes.apple.com/WebObjects/MZFinance.woa/wa/authenticate
• retain its 302 Location and repost the original XML plist body to the assigned pod (including attempt=1)

Patch comparison: main...bboy910225:agent/legacy-auth-fallback

go test ./... passes locally.

I also attempted to open the upstream PR from this fork; GitHub returned CreatePullRequest permission error for this account, so the compare link contains the ready-to-open PR diff.

[majd]

Upstreaming the fix from above: #514

[missaustraliana]

patch worked on my end, thank you so so much, i'll leave it open until its merged

[Fesh-com]

I still cannot login. ipatool version 2.3.2
tried a few times, got 2FA code once on my devices, entered 6 digits, but then got:
"request failed: unexpected response from Apple (HTTP 204): empty or non-plist body"

other errors:
"request failed: unexpected response from Apple (HTTP 503): 503 Service Temporarily Unavailable"
"something went wrong"
"failed to retrieve redirect location: header not found"

Oh, wait, the 10th try or so succeeded. I was then able to download an iPhone app on my Mac. Yeah.
So if it doesn't work for you, keep trying until it does...

[9k00]

I use the new feature in my code，but the error got back agin yesterday。