How to get .ROBLOSECURITY cookie in python?

Help and Feedback Scripting Support
#1

I am attempting to make a python script that gets my .ROBLOSECURITY cookie and prints it to the console. I have tried using the requests library, like this:

    import requests
    url = 'https://roblox.com/home'

    headers = {}
    
    response = requests.get(url, headers=headers)

    print(response.cookies.get_dict())

This just returned a few cookies that didn’t have any .ROBLOSECURITY or any other cookies that you would see if you inspected your roblox page. (Now it has broken and is returning an empty dictionary “{}”, FYI, but this doesn’t really matter the point is it’s not working.)

How can I properly get the cookies associated with roblox? I would appreciate help as I have tried a lot and am really stuck. Thank you!

TL;DR: I want to know how to get the .ROBLOSECURITY cookie with pure python.

#2

I don’t think the problem is with using Python; I’m 90% sure Roblox has blocked all HTTP requests to its website. You can only use set methods, such as Players:GetUserIdFromNameAsync, etc. so you probably need a proxy.
someone please correct me if I’m wrong, I’m not completely sure on this one.

#3

As far as I know, this is in lua, you cannot make requests to roblox from within the game using lua, but you can from outside the game using other programming languages such as python and node.js. I have done it before with other requests but I don’t know how to get the .ROBLOSECURITY cookie. Roblox’s API docs: Swagger UI. (Correct me if im wrong and plz try to help cuz im really stuck here lol!! Thanks for the response)

#4

Do you know how I can get the cookie?

#5

I don’t, sorry. I only use Luau in Roblox, I have no clue about Python in the context of Roblox. I just assumed it was a plugin that converted to Luau code, if it is, you probably won’t be able to get it.

Why do you want to get it? You might want to check the ToS because it contains important information that (I’m pretty sure) can be used to get into your account, it’s probably not possible to get it.

#6

I know nothing of that language but this looks like a place to start?

#7

I have tried making requests to get cookies and it works with most websites but not roblox. For roblox it returns like 2 cookies one called “GuestId” or something. It is very strange because this is not what you will see if you inspect roblox.

#8

Why are you trying to do this? Do you really think Roblox would provide anyway to just GET a session id like that on a local device? This could lead to SOOO many security issues, even if there was a way it probably wouldn’t be allowed, why would there be anyway to get that id from a request??

#9

I think that the python requests module doesn’t have your cookies stored. So if you create a session or perform a requests.get() using requests it wont use your browser stored cookies and it will appear as if you’re browsing the Roblox website on an incognito tab(meaning no cookies/login available).

To fetch a Roblox website as if it was you you need code that interacts directly with your browser or just manually copy paste the session/cookie. The easiest option here is to manually copy paste it by copying it from a request Cookie header within your browser inspect element window.

If you want to automatically create cookies by using your username and password I assume it will be much harder due to Roblox trying to stop botted behaviour.

Alternatively you can try searching for your browser saved cookies within your file system, however that is likely to differ depending on browser and version. Also you might be stopped by security measures(such as encryption).

#10

You’re wrong, Roblox has blocked all HTTP traffic made by HttpService to the roblox.com domain as a security measure. However Roblox servers can(and do) make requests to the Roblox website directly(on the background, abstracted by services and function calls). Also Roblox doesn’t stop requests that aren’t made through HttpService, for example by a python script.

#11

I am trying to do this so I can automate the process of getting the .ROBLOSECURITY cookie so I can then make API calls with my account. I want to do this automatically, I know I can copy paste it but I don’t want to.

Secondly, Roblox wouldn’t provide a method to do this directly but there would definitely be a way to get a website’s cookies, even roblox.

#12

This makes a lot of sense.

Is there any way I can make roblox think I am not on an incognito browser, in fact I am in my account and it will load all cookies for my account?

#13

To see what your account sees you just need your cookie. To see exactly what your browser session sees you need the entire cookie, local storage, etc. basically a perfect copy. One way is to make your script directly interact with the browser somehow(maybe there’s a library for this) or as mentioned above make a browser-specific script that tries to find the cookies stored on the file system of your machine itself. Then you just need to find the Roblox cookies within the cookies file(that’s how viruses work so the browser you use may make things more complicated than that).

If I’m not mistaken cookies aren’t designed with the purpose of being shared over the internet(quite the opposite to be specific) so having a “Cookie fetch API” sounds counter-intuitive.

#14

Okay, thank you I will try this method and get back to you.

#15

It is, because it’s not meant to be. It’s like trying to share variables across scripts, it doesn’t work that way.

#16

This isn’t a “scripting” question. It’s Python, and even though that is a scripting language it’s not what this subtopic is for (Luau Roblox).

But I will do the best I can. One thing I do know is that that cookie is most likely HTTP only, so you’re going to have some trouble accessing it through the client-side.

You can probably look into how cookie-loggers work, to gain an understanding of it, and make one (FOR YOURSELF, NOT FOR ANYONE ELSE). For instance, it may be possible to generate a .HAR file through script (python), or, find them in your local machine through some file navigating library.

" C:\Users\Your_User_Name\AppData\Local\Google\Chrome\User Data\Default\Network "

If you’re using chrome, you should be able to find cookies there, I wouldn’t know, I don’t use it

source:
Complete Guide to Cookies and Where They're Stored | All About Cookies.

As a disclaimer, I’m not teaching you how to make a cookie logger, I’m just teaching you how to find your own cookies, for anyone reading this.

2 Likes
#17

To add to this, it’s highly possible most chromium based browsers have cookies in the Network folder. Although the path that leads to it might be slightly different(for example instead of Google another name, etc). I think the file is an SQLite database. So perhaps it can be opened using the python sqlite3 library.

In order to access the Cookies file within the Network folder the browser must be closed. Else it wont let you interact with it due to being used by another process(the browser).

Please don’t use this information to make a malicious cookie logger.

1 Like
#18

Sorry. Didn’t really know where else to post this. Thanks for all the help, and thanks @NyrionDev .

Thought cookies were entirely client-side and were stored on the client, but idk.

Thank you! Will try this.

1 Like
#19

Well, your local machine COULD be considered as client-side in this case, you are pretty much correct.

#20

Where would I be able to find this file? I have looked for a long time. it is not in C:\Users\Your_User_Name\AppData\Local\Google\Chrome\User Data\Default\Network - Is there a chance it’s to do with having multiple chrome profiles? I noticed a directory called “Profile 1” Inside C:\Users\Your_User_Name\AppData\Local\Google\Chrome\User Data. Anyway, thanks for any help.