bobbybee wrote:

Here is, first of all, the wizard's spellbook; written by the Scratch Team, it should be your first go-to spot for using the API: https://github.com/LLK/scratch-rest-api/wiki.

Chibi-Matoran wrote:

Excuse me, but I wrote some scripts, and they seem to be broken. Others don't know why, and thing that it has something to do with the “CSRF token.” Could someone please check out the problem? https://scratch.mit.edu/discuss/topic/185982/

Thank you!

3.5 You agree not to use Scratch in any way intended to disrupt the service, gain unauthorized access to the service, or interfere with any other user's ability to use the service. Prohibited activities include, but are not limited to:

1. Posting content deliberately designed to crash the Scratch website or editor;
   
2. Linking to pages containing viruses or malware;
   
3. Using administrator passwords or pretending to be an administrator;
   
4. Repeatedly posting the same material, or “spamming”;
   
5. Using alternate accounts or organizing voting groups to manipulate site statistics, such as purposely trying to get on the “What the Community is Loving/Remixing” rows of the front page.
   

Firedrake969 wrote:

It's to prevent CSRFs. Hence the “token” part of the name

Your program --- ? --- Scratch site

Your program >> REQUEST FOR USER 1 OF SITE >> Scratch servers

Scratch servers >> USER 1 OF SITE IS wrgsfhwbxvb >> Your program

Your program >> REQUEST FOR POSTING COMMENT "Congratulations for being 1st user of site" TO USER wrgsfhwbxvb >> Scratch servers

Scratch servers >> YOUR REQUEST WAS CARRIED OUT SUCCESSFULLY >> Your program

1. You kidnap Phasma.
   
2. You force Phasma to disable shields.
   
3. The Starkiller OS recognizes Phasma's login and trusts her. The OS complies and disables shields.
   
4. Starkiller Base goes boom boom.
   

liam48D wrote:

Lots of requests require a CSRF token. That's the little token your browser and Scratch share that lets you do lots of things on Scratch, especially things that will in any way interact with the community.

When you log in, a cookie gets assigned to you. Part of it lists your CSRF token. Here's an example of response cookies from /account/login:

scratchsessionsid=[very very very long string]
scratchcsrftoken=[not so long string]

Those are the two tokens you'll need to use the site or interact with the API. Remember, if you get a CSRF validation error, all you need to do is modify your HTTP request:

X-CSRFToken: [scratchcsrftoken cookie]

Easy!

Chibi-Matoran wrote:

liam48D wrote:

Lots of requests require a CSRF token. That's the little token your browser and Scratch share that lets you do lots of things on Scratch, especially things that will in any way interact with the community.

When you log in, a cookie gets assigned to you. Part of it lists your CSRF token. Here's an example of response cookies from /account/login:

scratchsessionsid=[very very very long string]
scratchcsrftoken=[not so long string]

Those are the two tokens you'll need to use the site or interact with the API. Remember, if you get a CSRF validation error, all you need to do is modify your HTTP request:

X-CSRFToken: [scratchcsrftoken cookie]

Easy!

How do I do that? Why does my code not run, even though I use it when logged in, and can send the same requests through manually clicking buttons?

// get CSRF token
var csrfToken = document.cookie.match(/scratchcsrftoken=([^;]+)/)[1];
// set xhr header, assume we already have an XMLHttpRequest that has not yet
// been sent (but I think it has to be opened first)
xhr.setRequestHeader('X-CSRFToken', csrfToken);
// now we can send it or do other things
...
xhr.send();

Paddle2See wrote:

Note that scripting to follow large numbers of Scratchers, posting comments to large numbers of Scratchers, adding tons of projects to a studio, etc., is considered spamming and a misuse of system resources.

Chibi-Matoran wrote:

Paddle2See wrote:

Note that scripting to follow large numbers of Scratchers, posting comments to large numbers of Scratchers, adding tons of projects to a studio, etc., is considered spamming and a misuse of system resources.

Am I allowed to attempt to mass-unfollow people or mass-unfavorite projects, considering that API request time limits are followed? I'm trying to do that.

Chibi-Matoran wrote:

Paddle2See wrote:

Note that scripting to follow large numbers of Scratchers, posting comments to large numbers of Scratchers, adding tons of projects to a studio, etc., is considered spamming and a misuse of system resources.

Am I allowed to attempt to mass-unfollow people or mass-unfavorite projects, considering that API request time limits are followed? I'm trying to do that.

PullJosh wrote:

Definitely an old topic, but I've got a relevant question:

Is it possible, using the API, to find the username of the person who is currently logged in? I want to create a page where, using JS, I can grab some information specific to the user without needing them to type their username.

I feel like this was a thing at one point but I can no longer find it.