Headers and authorization

Set session-wide Authorization (Bearer JWT)

s.headers is the default header dictionary used by the requests.Session. update() stores the Bearer token there so every later request through that session includes the same Authorization header.

def auth(s):
    r = s.post(url=AUTH_URL, json={"email": ADMIN_EMAIL}, verify=False, proxies=PROXIES, timeout=10)
    json_response = r.json()
    token = json_response.get("token")
    if not token:
        print("[-] Failed to get JWT.")
        sys.exit(1)
    return token

token = auth(s)
s.headers.update({"Authorization": f"Bearer {token}"})

_{Find by: jwt, bearer, authorization header, token, headers update, api auth, session header · Source: CWEE/JS Injection}

Custom request headers / X-Forwarded-For source-IP spoof

A custom header dictionary can be passed through headers= for one request or stored through s.headers.update() for the complete session.

X-Forwarded-For normally records the original client address when a trusted reverse proxy forwards a request. The TCP source address does not change when a client sets this header. A bypass exists only when the reverse proxy accepts an attacker-supplied value or when application code trusts the header directly for an authorization decision. Alternative names such as X-Real-IP, X-Originating-IP, Client-IP, and X-Remote-Addr matter only when the deployed proxy or application explicitly reads them.

HEADERS = {
    "X-Forwarded-For": "127.0.0.1",
}
r = s.get(url=URL, headers=HEADERS, verify=False, proxies=PROXIES, timeout=10)

# apply to every request on the Session instead of per call:
# s.headers.update(HEADERS)

_{Find by: custom headers, headers dict, x-forwarded-for, xff, source ip spoof, ip bypass, localhost only, internal only, x-real-ip, client-ip, x-originating-ip, access control bypass, trusted header · Source: PG/many}