CODEWITHSUNDEEP
pythonapihttphttp-status-code-403
johan855
johan855

Reputation: 1626

403 error when accessing API from server and not from browser

I am trying to access the Buxfer REST API using Python and urllib2.

The issue is I get the following response:

urllib2.HTTPError: HTTP Error 403: Forbidden

But when I try the same call through my browser, it works fine...

The script goes as follows:

username = "xxx@xxxcom"
password = "xxx"

    #############

def checkError(response):
    result = simplejson.load(response)
    response = result['response']
    if response['status'] != "OK":
        print "An error occured: %s" % response['status'].replace('ERROR: ', '')
        sys.exit(1)

    return response

base = "https://www.buxfer.com/api";
url  = base + "/login?userid=" + username + "&password=" + password;

req = urllib2.Request(url=url)
response = checkError(urllib2.urlopen(req))
token = response['token']

url  = base + "/budgets?token=" + token;
req = urllib2.Request(url=url)
response = checkError(urllib2.urlopen(req))
for budget in response['budgets']:
    print "%12s %8s %10.2f %10.2f" % (budget['name'], budget['currentPeriod'], budget['limit'], budget['remaining'])

sys.exit(0)

I also tried using the requests library but the same error appears. The server I am tring to access from is an ubuntu 14.04, any help on explaining or solving why this happens will be appreciated.

EDIT:

This is the full error message:

{                                                                                                            
  'cookies': <<class 'requests.cookies.RequestsCookieJar'>[]>,                                               
  '_content': '                                                                                              
    <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">                                                       
    <html><head>                                                                                             
    <title>403 Forbidden</title>                                                                             
    </head><body>                                                                                            
    <h1>Forbidden</h1>                                                                                       
    <p>You don't have permission to access /api/login                                                        
    on this server.</p>                                                                                      
    <hr>                                                                                                     
    <address>Apache/2.4.7 (Ubuntu) Server at www.buxfer.com Port 443</address>                               
    </body></html>',                                                                                         
  headers': CaseInsensitiveDict({                                                                            
    'date': 'Sun, 31 Jan 2016 12:06:44 GMT',                                                                 
    'content-length': '291',                                                                                 
    'content-type': 'text/html; charset=iso-8859-1',                                                         
    'server': 'Apache/2.4.7 (Ubuntu)'                                                                        
  }),                                                                                                        
  'url': u'https://www.buxfer.com/api/login?password=xxxx&userid=xxxx%40xxxx.com',                           
  'status_code': 403,                                                                                        
  '_content_consumed': True,                                                                                 
  'encoding': 'iso-8859-1',                                                                                  
  'request': <PreparedRequest [GET]>,                                                                        
  'connection': <requests.adapters.HTTPAdapter object at 0x7fc7308102d0>,                                    
  'elapsed': datetime.timedelta(0, 0, 400442),                                                               
  'raw': <urllib3.response.HTTPResponse object at 0x7fc7304d14d0>,                                           
  'reason': 'Forbidden',                                                                                     
  'history': []                                                                                              
}

EDIT 2: (Network parameters in GoogleChrome browser)

Request Method:GET
Status Code:200 OK
Remote Address:52.20.61.39:443
Response Headers
view parsed
HTTP/1.1 200 OK
Date: Mon, 01 Feb 2016 11:01:10 GMT
Server: Apache/2.4.7 (Ubuntu)
X-Frame-Options: SAMEORIGIN
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Cache-Controle: no-cache
Set-Cookie: login=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=buxfer.com
Set-Cookie: remember=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=buxfer.com
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/x-javascript; charset=utf-8
Request Headers
view source
Accept:text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding:gzip, deflate, sdch
Accept-Language:en-US,en;q=0.8,fr;q=0.6
Connection:keep-alive
Cookie:PHPSESSID=pjvg8la01ic64tkkfu1qmecv20; api-session=vbnbmp3sb99lqqea4q4iusd4v3; __utma=206445312.1301084386.1454066594.1454241953.1454254906.4; __utmc=206445312; __utmz=206445312.1454066594.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=(not%20provided)
Host:www.buxfer.com
Upgrade-Insecure-Requests:1
User-Agent:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.97 Safari/537.36

EDIT 3:

I can also access through my local pycharm console without any issues, it's just when I try to do it from my remote server...

Upvotes: 5

Views: 19235

Answers (2)

carrvo
carrvo

Reputation: 638

To affirm @Carl from the offical website:

This command only looks at POST parameters and discards GET parameters.

https://www.buxfer.com/help/api#login

Upvotes: 0

Carl
Carl

Reputation: 1045

It could be that you need to do a POST rather than a GET request. Most logins work this way.

Using the requests library, you would need

response = requests.post(
    base + '/login',
    data={
        'userid': username,
        'password': password
    }
)

Upvotes: 2

Related Questions