使用多个令牌发布 CSRF 令牌？

Question

我一直在尝试通过登录（使用 yelp）来抓取网站。为了更好地理解的第一个问题：我遵循了一些教程来获得这些想法，并注意到它们都使用 CSRF 令牌制作字典，但是，当我抓取 yelp 登录站点时，我发现了 6 个令牌。我知道我的字典中不能有重复的键，所以本教程使用字典来处理这种冗余/不正确的情况，因为我只会得到最后一个标记？

其次，如果有多个令牌，你使用哪个？或者你如何使用它们？我似乎无法登录，并阅读了 BeautifulSoup 和 Requests 的文档，并在昨晚搜索了 Stack。代码如下。 感谢您的任何解释。

s = requests.session()
login = s.get('https://www.yelp.com/login')

soup = BeautifulSoup(login.text, 'html.parser')
tokenList = soup.find_all(type = 'hidden', attrs={"name": "csrftok"})
c = login.cookies  #Just peeked into cookies to see if there is a token 
print(c)

keys = [x.attrs["name"] for x in tokenList]
values = [x.attrs["value"] for x in tokenList]
#If I print these two lists, I get 6 keys of the "csrftok" String, and 6 
#different keys.  

email = "my email"
password = "my password"
#I tried creating a dictionary with zip of all the tokens, etc. This 
#is an attempt just using the first key and value I find.
d = {'email': email, 'password': password, keys[0]: values[0]}
response = s.post('https://www.yelp.com/login', data = d)

print(response.url)

Answer 1

你试过这样吗？我认为它应该引导你走向正确的方向：

s = requests.session()
login = s.get('https://www.yelp.com/login')

soup = BeautifulSoup(login.text, 'lxml')
token = soup.select(".csrftok")[0]['value']

email = "my email"
password = "my password"

headers={
'accept':'application/json, text/javascript, */*; q=0.01',
'accept-encoding':'gzip, deflate, br',
'content-type':'application/x-www-form-urlencoded; charset=UTF-8',
'referer':'https://www.yelp.com/login',
'user-agent':'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36',
'x-distil-ajax':'fytrybseesxsvsresb',
'x-requested-with':'XMLHttpRequest'
}

payload = {
'csrftok':token,
'email':email,
'password':password,
}

response = s.post('https://www.yelp.com/login/newajax', data = payload, headers=headers)
print(response.url)