The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF cookie isn't provided.

If s.proxies is commented out so that the program isn't being run via a proxy, it works just fine without error, and Instagram.com provides a CSRF token cookie.

So my question is: how does Instagram detect that I'm running the program from a proxy? In other words, how does it differentiate between a normal request and a request running through a proxy?

import requesocks
import requests

s = requesocks.session()
# Tor uses the 9050 port as the default socks port
s.proxies = {'https': 'socks5://'}
url = 'https://www.instagram.com/accounts/web_create_ajax/'
tok = s.cookies['csrftoken']

#Traceback (most recent call last):
#File "tor.py", line 24, in <module>
#tok = s.cookies['csrftoken']
#KeyError: 'csrftoken
  • 6
    are you sure its instagram that is filtering out the csrf token? I would not be so quick to assume the proxy is blameless in this.
    – LvB
    Apr 18, 2016 at 11:51
  • 3
    "..through any sort of https or socks5 proxy.." - really any sort? Or just any kind of proxy which uses Tor or other common privacy enhancing technologies as the endpoint? Did you try with a local proxy installation which uses your original IP address as source of the requests? Apr 18, 2016 at 12:39
  • 1
    Could you add a line to print s.cookies? Perhaps 'csrftoken' is CSRFToken so it's the capitalization that's fooling you..
    – lorenzog
    Feb 3, 2017 at 9:13
  • Proxies might add HTTP headers like X-Forwarded-For. Detecting these headers server-side can be enough to consider you're behind a proxy. But I'm not sure that the "how does instagram detect I'm behind a proxy" is relevant in your issue.
    – Xenos
    Jun 28, 2018 at 14:52

1 Answer 1


It's simple =) In no-proxy case you're tracing all the redirects yourself, so it's no problem to handle it. A proxy can be tricky as the proxy itself(not Tor case, but there are programs that behave a bit weird), so the proxy component for your language can be. Especially it happens frequently with HTTP and HTTPS proxies. Use a tcpdump - it will show you the problem. If you will see no csrf token in your proxy-to-your-code dump, then take a look, maybe it's a captcha page or something. If you actually see a csrf token in a dump, but not in your code - the proxy component is a problem for sure

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .