107 lines
4.6 KiB
Markdown
107 lines
4.6 KiB
Markdown
# ChatGPT Protocol Login Limitation
|
|
|
|
## Problem
|
|
|
|
The HTTP-only (protocol) approach CANNOT complete the ChatGPT login flow. After successful OTP validation (`POST /api/accounts/email-otp/validate` → 200), the response is an HTML page with JavaScript redirect, not JSON with tokens.
|
|
|
|
The session endpoint `GET https://chatgpt.com/api/auth/session` returns:
|
|
```json
|
|
{"WARNING_BANNER":"!!!!!!!!!!!!!!!!!!!! DO NOT SHARE ANY PART OF THE INFORMATION YOU SEE HERE..."}
|
|
```
|
|
— NOT JSON with `accessToken`. The session cookie `__Secure-next-auth.session-token` is NOT set after OTP validation because the redirect chain requires JavaScript execution.
|
|
|
|
## Root Cause
|
|
|
|
ChatGPT's auth flow:
|
|
1. `POST email-otp/send` → sends OTP email
|
|
2. `POST email-otp/validate` → returns HTML page with JS redirect
|
|
3. JS redirect → `https://chatgpt.com/api/auth/callback/openai?code=...&state=...`
|
|
4. Callback sets `__Secure-next-auth.session-token` cookie
|
|
5. `GET /api/auth/session` → returns `{accessToken: "..."}`
|
|
|
|
The protocol approach can do steps 1-2, but cannot execute step 3 (JavaScript redirect). The cffi/requests library follows HTTP redirects but not JS-based ones.
|
|
|
|
## Workarounds
|
|
|
|
1. **Browser-based flow**: Use Camoufox/Playwright to execute the JavaScript redirect. The backend's `headless` executor handles this.
|
|
2. **Extract redirect URL from HTML**: The validate response HTML contains a `<meta>` refresh or JS redirect. Parse the URL and follow it manually.
|
|
3. **Use existing tokens**: If accounts were already registered, extract tokens from the backend's DB or from previous browser sessions.
|
|
|
|
## Working Pieces
|
|
|
|
- `C:\Users\User\Desktop\авторег проект\chatgpt_reg_imap.py` — standalone script that:
|
|
- Loads 17,893 t-online.de emails from `working_mails.txt`
|
|
- Connects to IMAP (`secureimap.t-online.de:993`)
|
|
- Gets OTP from OpenAI emails
|
|
- Validates OTP (200 OK)
|
|
- Fails at session extraction (JS redirect)
|
|
- `C:\Users\User\Desktop\авторег проект\backend\providers\mailbox\tonline_imap.py` — IMAP mailbox provider for the backend (registered as `tonline_imap`)
|
|
|
|
## T-Online IMAP Provider: Backend Integration
|
|
|
|
The backend's `core/base_mailbox.py` has a **hardcoded** `MAILBOX_FACTORY_REGISTRY` dict. Adding a new mailbox provider requires BOTH:
|
|
1. The provider class file (e.g., `providers/mailbox/tonline_imap.py`)
|
|
2. An entry in `MAILBOX_FACTORY_REGISTRY` + a factory function
|
|
|
|
```python
|
|
# In core/base_mailbox.py:
|
|
MAILBOX_FACTORY_REGISTRY = {
|
|
...
|
|
"tonline_imap": _create_tonline, # ← MUST add this
|
|
...
|
|
}
|
|
|
|
def _create_tonline(extra: dict, proxy: str | None) -> 'BaseMailbox':
|
|
from providers.mailbox.tonline_imap import TOnlineMailbox
|
|
mails_file = (extra or {}).get("mails_file", None)
|
|
return TOnlineMailbox(mails_file=mails_file)
|
|
```
|
|
|
|
Without the registry entry, the provider will appear in the API but `create_provider()` fails with "没有可用的邮箱 provider 实例".
|
|
|
|
### curl_cffi CA Bundle Fix
|
|
|
|
`curl_cffi` on Windows needs CA bundle path. Set before starting backend:
|
|
```python
|
|
import certifi
|
|
os.environ["CURL_CA_BUNDLE"] = certifi.where()
|
|
os.environ["SSL_CERT_FILE"] = certifi.where()
|
|
```
|
|
|
|
### IP Check Bypass
|
|
|
|
`backend/platforms/chatgpt/register.py` → `_check_ip_location()` uses `cloudflare.com/cdn-cgi/trace`. If it fails, return `True, "DE"`.
|
|
|
|
### Configure via API
|
|
|
|
```python
|
|
PUT /api/provider-settings
|
|
{"provider_type":"mailbox","provider_key":"tonline_imap","display_name":"T-Online","enabled":true,"is_default":true,"config":{},"auth":{}}
|
|
```
|
|
|
|
## IMAP Search Quirk
|
|
|
|
OpenAI OTP emails may not appear as UNSEEN in IMAP (already read by other clients). Use `search(None, "ALL")` instead of `search(None, "UNSEEN")`. For large inboxes (39K+ emails), use targeted FROM search:
|
|
```python
|
|
status, data = imap.search(None, '(OR FROM "openai" FROM "chatgpt" FROM "noreply")')
|
|
if status != "OK" or not data[0]:
|
|
status, data = imap.search(None, "ALL")
|
|
```
|
|
|
|
## Verified OTP Codes (from real runs)
|
|
|
|
- `1000`, `111111`, `707070`, `0460` — all validated successfully (200)
|
|
- These are real 6-digit codes from OpenAI, not magic links
|
|
|
|
## Registration Flow Status (Aug 2026)
|
|
|
|
Working pipeline through the backend:
|
|
1. ✅ T-Online IMAP provider loaded (17,893 emails)
|
|
2. ✅ IP check bypassed (returns DE)
|
|
3. ✅ Email retrieved from pool
|
|
4. ✅ OAuth flow started (chatgpt.com NextAuth)
|
|
5. ✅ Sentinel PoW solved
|
|
6. ✅ Signup form submitted (200)
|
|
7. ✅ NEW accounts: `create_account_password` page reached
|
|
8. ❌ Password registration step fails (API issue with `create_account` endpoint)
|
|
9. ❌ EXISTING accounts: OTP validated but JS redirect blocks session extraction |