Hey there! If you’re 100% sure that your .ROBLOSECURITY is valid, your account has access to group shout and the group ID is correct (these 2 would throw a different error anyway), it’s the absence of an X-CSRF-Token that is causing the issue. (Evident from the code you provided anyway)
What is an X-CSRF-Token? A CSRF (Cross-Site Request Forgery) token is something that is used by the server of a website and your browser to make sure that you’re not a malicious user trying to post data into a server. A server will do this by generating a token when you visit the URL, and sending it back to you during browser loading, then when you say, try to send a reply to a thread maybe on that webpage, the X-CSRF-Token (in Roblox’s case) is checked to make sure you’re a valid connection.
Image
How do you generate one? The method I use with my internal systems, is I send a POST request to http://auth.roblox.com with my .ROBLOSECURITY, and if successful, it returns an X-CSRF-TOKEN header. Once I have that header, I cache it in memory on my program. Every time I send a patch, post, put, or delete request (etc) to Roblox, I send the request with that token. If the response is Token Validation Failed, I refresh the X-CSRF-Token in memory and send the request a second time. If it fails after the second time, then something else is wrong. This is the method I do it, it’s the method that Noblox.js does it. Here’s an example below, it’s in JS but the concept is the same.
async patch<K>(url: string, data?: {[key: string]: any}): Promise<AxiosResponse<K, any> | AxiosError> {
data = await this.construct(data); // Constructing the URL with the headers
var body = data.body || {};
delete data.body; // Stuid axios stuff, ignore
var patch = await axios.patch<K>(url, body, data).catch(err => err); // First attempt
const response = patch.statusText || (patch.response && patch.response.data && patch.response.data.message);
if (response && response.includes("Token Validation Failed")) {
this.cache.refreshCSRFToken(); // X-CSRF-Token refresh
patch = await axios.patch<K>(url, body, data).catch(err => err); // Second attempt
}
return patch;
}
tl;dr
Send a POST request to http://auth.roblox.com with your .ROBLOSECURITY, it will return a X-CSRF-Token, send that with the group shout in headers. If the shout fails the first time for the EXACT reason of Token Validation Failed OR XCSRF Token Validation Failed (Noblox.js includes this but I’ve never seen this error before), refresh the X-CSRF-Token and attempt the request again. If it still fails, something else is wrong.
