When downloading AAXC 403 Forbidden

[CuriousEl3phant502]

When using the example code to download an AAXC from my library I am now receiving 403 Forbidden response codes. This worked fine before, but has just started this month. I'm able to authenticate, and pull down a fresh library list.

To Reproduce
Steps to reproduce the behavior:

1. Use the example code from download_books_aaxc.py on line 38.

with httpx.stream("GET", url) as r:

2. The response comes back as a 403.

Relevant Dependencies:
httpx v0.16.1
audible v0.5.4 (this library)

I have made no changes in the last few months, and it has worked fine until now. Last known working was late April 2021. But after trying it in the last couple days (with no changes) I now get a 403 forbidden. Can't seem to figure out what is different or the reason for the 403. Audible API change?

However, if I take the URL that it's attempting to use it will work just fine in the browser (not logged in and all history/cache/cookies cleared). However it seems to download an aax file not an aaxc file. But nonetheless a file is downloaded- no 403. I've never tried to put the URL in the browser before now so I'm not sure what the expected behavior is.

[mkb79]

That sounds really strange. I tried downloading several books as aax and aaxc today and all is running as expected.

Which marketplace you are using? The book you are trying to download is a book you have bought?

Can you try my audible-cli package?

[CuriousEl3phant502]

Yeah it is strange. I have not seen this before. Sure I can try the cli. It was 3 different books I bought and a couple "included" ones- all had the same issue. Those were all of the ones i tried. It was from the US marketplace.

[CuriousEl3phant502]

So i pulled down a new copy of the regular audible project (0.5.4), and retried the example code. Still 403. However, when I setup the cli (0.5.3) project it worked. Assuming nothing significant in the two minor versions, it looks like the difference is httpx.AsyncClient.stream vs httpx.stream. It seems maybe the audible service changed. Before the URL params given by audible were enough to authenticate/authorize, but now it is not the case.

Also, even in your cli project the download URL says its for an aax file even though I was requesting an aaxc file.

[mkb79]

I saw in your opening post that you wrote with httpx.stream("GET", url) as r:. This means the request is not authenticated.

Can you try the following:

auth = audible.Authenticator.from_file(…)

with httpx.stream("GET", url, auth=auth) as r:

[CuriousEl3phant502]

This gives a 403 as well. For some reason you need to use a client/async client object now-

auth = audible.Authenticator.from_file(…)

with httpx.Client(auth=auth).stream("GET", url) as r:

Maybe you'll find some solution i didnt see, but this is the only way I've seen it work starting this month.

[jesseconnr]

It seems httpx.stream does not send some of the required headers that httpx.Client does. You can add the headers manually as seen in the example gist. I didn't find anything in the httpx github issues so I'm not sure if this is a bug or expected. Also, if you're using offline_url, the auth portion is not required.

https://gist.github.com/jesseconnr/18ab04422ad11a7b93c205a2f4f5fdb3

[mkb79]

Thank you booth for your very important information. I will take a look on the httpx source code.

FYI:
I‘m short on time this week but I will give my best.

[jesseconnr]

Here's some additional discovery on the httpx versions.

0.16.1 - missing headers (audible depends on 0.16.*)
0.18.1 - sends all headers (this is the latest version)
0.14.3 - also sends all headers (this is just a version an older project of mine was using)

If there aren't any breaking changes it could be as easy and updating the dependency but either way it's an easy thing to work around.

[mkb79]

@jesseconnr Thank you for your work! I've created a pr now to update httpx to 0.18.x for testing.