What solutions have you tried so far?
I’ve read the tutorial linked above, but I don’t fully understand how to get the x-csrf-token from the response headers. I’ve attempted to manually inspect the request headers, but I’m still not sure how to get the token or attach it to the POST request.
If anyone has worked with the Quick Login API or knows how to get the x-csrf-token, I’d really appreciate the help!
The X-CSRF token lives in the response headers when you get this specific error.
Roblox took down the doc sites after I wrote what you linked, but just send the response again with the retrieved token.
local function jHttpRequest(req)
if not req.headers then
req.headers = {}
end
req.headers.Accept = "application/json"
req.headers["Content-Type"] = "application/json"
req.body = serde.encode("json", req.body)
local res = net.request(req)
if not res.ok then
-- if its xcsrf, we need to handle again
if res.headers then
req.headers["x-csrf-token"] = res.headers["x-csrf-token"]
res = net.request(req)
end
end
if not res.ok then
return false, {
httpMessage = res,
body = res.body,
sentMessage = req.body
}
end
return true, {
httpMessage = res,
body = serde.decode("json", res.body),
sentMessage = req.body
}
end
(this is for a different luau runtime but hopefully you can figure out what each bit does)
Its also worth noting that quick login does use some form of public IP check when it validates login codes, so if you’re doing this for a web server, keep that in mind.