How is challenge/response supposed to work?

[jlobos]

How is challenge/response supposed to work?

[mkgerasimenko]

@gutosanches, I may have solved that problem with:

await client.updateChallenge({challengeUrl, choice: 1});
await client.updateChallenge({ challengeUrl, securityCode: 'VERIFICATION_CODE_FROM_EMAIL'});

In my case I need to update Challenge with security code from Instagram email.

Full code (TS):

public async login(): Promise<Instagram> {
        const client = new Instagram({username: this.username, password: this.password});
        try {
            await client.login();
        } catch (err) {
            if (err.error && err.error.message === 'checkpoint_required') {
                const challengeUrl = err.error.checkpoint_url;

                await client.updateChallenge({challengeUrl, choice: 1});
                await client.updateChallenge({ challengeUrl, securityCode: '301794'}); // <== securityCode - set code from email.
            }
        }
        return await client;
    }

Notes:

1. I use Gmail email for Instagram.
2. I use imap-simple for getting the Security code from Instagram Email.

[samholmes]

I spent a lot of time with these challenges in order to figure out the appropriate way to use the API. First, you'll need to save the challengeUrl returned from the login form. I then use getChallenge to get the challenge JSON object. From there you can read the challengeType which will determine what do to. Here's the challengeTypes that I found:

1. SelectVerificationMethodForm This is the form you see asking you whether to send the verification via email or mobile text. Use updateChallenge to set the choice, and after invocation, the verification email/text will be sent.
2. VerifyEmailCodeForm This is the form you see when asking for the verification code from email. This doesn't require a choice when calling updateChallenge (in fact, I believe it will give an error). Instead, send the securityCode with the updateChallenge invocation. If no security code was sent, you can use replayChallenge to have the security code sent again.

There may be other challengeTypes worth documenting, but these are enough to get a working challenge passing algorithm started. I would log any other challenge types that aren't handled by your app, and share them with some context so we can all figure out what they mean and document them.

Cheers!

[gutosanches]

I'm trying to implement the flow suggested above ^ but I'm also getting that same This page could not be loaded. error (and also in HTML) when trying to call updateChallenge. Opening the challengeUrl on the browser directly shows the verification page as expected.

Anyone ran into this too and figured it out?

Here's what I'm doing:

1. Try to login
2. Get error with challenge_url
3. Call updateChalenge using challengeUrl and choice 1 for email, as suggested
4. Get error This page could not be loaded

[lucasvieceli]

I am using "imap-simple" to pick up the security code, but it is still returning error 400 :((

Google translate :D

export const getClientInstagram = async ({usuario, senha, cookie}) => {
    const contaRepository = getCustomRepository(ContaRepository);
    
    const client = new Instagram({
        username: usuario,
        password: senha,
        cookies: cookie
    }, {language: 'pt-BR'});

    try{
        const t = await client.login();
        await contaRepository.setCookiePorUsuario(usuario, t.cookies);
    }catch (err) {
        if (err.error && err.error.message === 'checkpoint_required') {
            const codigoSeguranca = await getCodigoSeguranca(usuario);
            

            if(codigoSeguranca) {
                const challengeUrl = err.error.checkpoint_url;

                await client.updateChallenge({challengeUrl, choice: 1});
                await client.updateChallenge({challengeUrl, securityCode: codigoSeguranca}); 
            }
        }
    }

    return client;
}

[chunheisiu]

Same Problem. Getting 400 checkpoint_required error messages.

My app runs in a Docker container, so I haven't figured out a way to read the security code from outside and then insert it into client.updateChallenge.

Any help/suggestions are appreciated.

[dmred]

Same Problem. Getting 400 checkpoint_required error messages.

My app runs in a Docker container, so I haven't figured out a way to read the security code from outside and then insert it into client.updateChallenge.

Any help/suggestions are appreciated.

Are there any decisions after more than one year?)