301 response missing Location header

[suntong]

Following up on #5 & #6,

Thanks for icepie's effort, I've made it pass the login scan step.
But this is what I'm getting now:

访问下面网址扫描二维码登录
https://login.weixin.qq.com/qrcode/obQ...Ztg==
Get "https://web.wechat.com/cgi-bin/mmwebwx-bin/webwxnewloginpage?ticket=ArU...V3NX@qrticket_0&uuid=obQ...Ztg==&lang=zh_CN&scan=1620481397": 301 response missing Location header

I'm logging in from oversea BTW. That might be the reason why WX asking for "Location header".

I've tried to use KW of mmwebwx-bin or webwxnewloginpage to search in this repo, but didn't find anything.
So I cannot tell where the problem comes from as of now.

Please take a look.

[suntong]

I thought adding a fake Location header to that get https://web.wechat.com/cgi-bin/mmwebwx-bin/webwxnewloginpage request might help, but on researching

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Location

It seems the problem is more from the server side. So I'm making another request to have more insight into the login handshaking #12.

[suntong]

Quoting from wechaty/puppet-wechat#127 (comment)

我本地测试了一个最简化的代码，发现 https://wx.qq.com/cgi-bin/mmwebwx-bin/webwxnewloginpage 是扫码点击确定后的跳转地址，所以不扫码确定看不到这个path。以下是我使用puppeteer写的最小demo，本地测试已经可以成功登陆网页端...

The KW mmwebwx-bin or webwxnewloginpage are indeed not in this repo.
It is the 扫码点击确定后的跳转地址.

[suntong]

Still from wechaty/puppet-wechat#127 (comment)

I think this comment might reveal what's missing:

This patch should be applied to the third step of login.

When you get a 200 from https://login.weixin.qq.com/cgi-bin/mmwebwx-bin/login, the response must contain window.redirect_uri="https://wx.qq.com/cgi-bin/mmwebwx-bin/webwxnewloginpage.

When requesting cgi-bin/mmwebwx-bin/webwxnewloginpage, this patch is needed. Besides, wxsid and wxuin should be obtained from Cookie, not XML response.

[eatmoreapple]

是的，这个问题开始我是找不到原因的，感谢您的提议，后面会去关注测试。

[eatmoreapple]

已修复！see https://github.com/golang/go/blob/cde2d857fe1f13ade269e3f7d58c6c2379a53c50/src/net/http/client.go#L647

[suntong]

When requesting cgi-bin/mmwebwx-bin/webwxnewloginpage, this patch is needed. Besides, wxsid and wxuin should be obtained from Cookie, not XML response.

I think the above is the reason that I'm getting the 301 response missing Location header error, i.e., if proper patch is applied and proper wxsid and wxuin is used when making the cgi-bin/mmwebwx-bin/webwxnewloginpage request, I might not see that loginForbiddenError error, I think.

comment?

[eatmoreapple]

这个问题的引发的原因是请求返回的response的状态码为301（跳转）, 但是在response在Header里面没有Location, 而是直接返回了一个禁止登陆的xml。(正常登陆会有这个Header)
go的client源码认为如果需要跳转响应的Header中没有Location(浏览器会根据这个字段跳转对应的网页)，则这个响应是一个不合法的response