The Python code below should grab a CSRF token cookie from Instagram.com, but I get an error message when running the program through any sort of HTTPS or SOCKS5 proxy, informing me that the CSRF cookie isn't provided.

If s.proxies is commented out so that the program isn't being run via a proxy, it works just fine without error, and Instagram.com provides a CSRF token cookie.

So my question is: how does Instagram detect that I'm running the program from a proxy? In other words, how does it differentiate between a normal request and a request running through a proxy?

import requesocks
import requests

s = requesocks.session()
# Tor uses the 9050 port as the default socks port
s.proxies = {'https': 'socks5://'}
url = 'https://www.instagram.com/accounts/web_create_ajax/'
tok = s.cookies['csrftoken']

#Traceback (most recent call last):
#File "tor.py", line 24, in <module>
#tok = s.cookies['csrftoken']
#KeyError: 'csrftoken
  • 6
    are you sure its instagram that is filtering out the csrf token? I would not be so quick to assume the proxy is blameless in this. – LvB Apr 18 '16 at 11:51
  • 3
    "..through any sort of https or socks5 proxy.." - really any sort? Or just any kind of proxy which uses Tor or other common privacy enhancing technologies as the endpoint? Did you try with a local proxy installation which uses your original IP address as source of the requests? – Steffen Ullrich Apr 18 '16 at 12:39
  • 1
    Could you add a line to print s.cookies? Perhaps 'csrftoken' is CSRFToken so it's the capitalization that's fooling you.. – lorenzog Feb 3 '17 at 9:13
  • Proxies might add HTTP headers like X-Forwarded-For. Detecting these headers server-side can be enough to consider you're behind a proxy. But I'm not sure that the "how does instagram detect I'm behind a proxy" is relevant in your issue. – Xenos Jun 28 '18 at 14:52

It's simple =) In no-proxy case you're tracing all the redirects yourself, so it's no problem to handle it. A proxy can be tricky as the proxy itself(not Tor case, but there are programs that behave a bit weird), so the proxy component for your language can be. Especially it happens frequently with HTTP and HTTPS proxies. Use a tcpdump - it will show you the problem. If you will see no csrf token in your proxy-to-your-code dump, then take a look, maybe it's a captcha page or something. If you actually see a csrf token in a dump, but not in your code - the proxy component is a problem for sure

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.