Implement a new system (still scraping) #4
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Blocks
#13 Implement new login system (supporting schools that updated to eduVULCAN)
wulkanowy/wulkanowy
Reference: wulkanowy/sdk#4
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
"Let's add HEBE routes" - still not done.
In all seriousness though, there is a new way of getting data from VULCAN, and it's only for schools/accounts that migrated to eduVULCAN, but allow for use of the previous way of logging in, ie. through the school link, login and password.
So how does it work?
Logging in (scraping part)
Heading to the usual login page we are met with this:

which replaces it.
The URL is:
https://uonetplus.vulcan.net.pl/{symbol}/We have these options:
This uses CUFS, which is one of the login types specified in the SDK (sdk-scrapper).
The URL is:
https://cufs.vulcan.net.pl/{symbol}/Account/LogOn?ReturnUrl={usual wsignin login}If the student hasn't updated his account to the new system yet, but the school uses the new system, they can still sign in just fine using the SDK.
This uses a new page, with one input per page (can be skipped)
The URL is:
https://dziennik-logowanie.vulcan.net.pl/{symbol}/Account/Logon?returnUrl=Note the new URL, this MIGHT vary per school (not sure)
This is actually a redirect, just like with the old system.
I will explain this approach further below.
What are the redirects?
First redirect (button press):
https://dziennik-uczen.vulcan.net.pl/{symbol}/LoginEndpoint.aspxSecond redirect (from the URL):
https://dziennik-logowanie.vulcan.net.pl/{symbol}/Fs/Ls?wa=wsignin1.0&wtrealm=https://dziennik-uczen.vulcan.net.pl/{symbol}/LoginEndpoint.aspx&wctx=auth=student&nslo=1This redirect sets these cookies:
At this request, we get a later needed token called
__RequestVerificationToken={value}in the cookies.Third redirect (from the URL):
/{symbol}/Account/Logon?returnUrl=http://dziennik-logowanie.vulcan.net.pl/{symbol}/Fs/Ls?wa=wsignin1.0&wtrealm=https://dziennik-uczen.vulcan.net.pl/{symbol}/LoginEndpoint.aspx&wctx=auth=student&nslo=1This has the root URL of
https://dziennik-logowanie.vulcan.net.pl/This is where we log in.
You can visit the login page by visiting any school that uses the new system, so a URL like https://dziennik-logowanie.vulcan.net.pl/warszawa/Account/Logon works just fine.
The script responsible for getting the verification token, along with some parsing info is located at
https://dziennik-logowanie.vulcan.net.pl/Scripts/logon.js?_=25.2.5.61914I will leave information about how to get said stuff later in the thread.
Logging in (the logic)
We first have to query the user (login) with a POST request to
https://dziennik-logowanie.vulcan.net.pl/{symbol}/Account/QueryUserInfo, that contains all our cookies, as well as this body:login={username}&__RequestVerificationToken={token}&nonce={generated nonce&nonceSignature={nonce signature}which responds with
{ "success": true, "data": { "ShowCaptcha": false } }.I suppose we should be ready for handling a captcha on login.
Once the query returns a success, we log in with our login, password, "captcha user" and the request verification token. To do that, we send a POST request to
https://dziennik-logowanie.vulcan.net.pl/{symbol}/Account/Logon?returnUrl=http://dziennik-logowanie.vulcan.net.pl/{symbol}/Fs/Ls?wa=wsignin1.0&wtrealm=https://dziennik-uczen.vulcan.net.pl/{symbol}/LoginEndpoint.aspx&wctx=auth=student&nslo=1with the body:Haslo={password}&captchaUser={empty}&Login={username}&__RequestVerificationToken={token}. This leads us to our fourth redirect.Fourth redirect (from the login request):
http://dziennik-logowanie.vulcan.net.pl/{symbol}/Fs/Ls?wa=wsignin1.0&wtrealm=https://dziennik-uczen.vulcan.net.pl/{symbol}/LoginEndpoint.aspx&wctx=auth=student&nslo=1This redirect also sets our cookies:
We then do a GET of the redirect, which has a hidden form (wsignin, like in other ways of signing in).
This gives us two new cookies:
The form looks like this:
Inside the wsignin, there's:
Fifth redirect: Since the form does a POST request, and it's wsignin, I won't really go in-depth about how to do it, it's automatic I think. It does redirect us to
/{symbol}though.It also sets these cookies:
Sixth redirect: Just
/{symbol}/App. No cookies.This is the last redirect that we get, after that we're in the user panel.
So what is actually going on in the panel?
Well, first things first: There is a script that gives us needed info, as well as a Set-Cookie header. The cookie is:
X-V-RequestVerificationToken(hashtag){some id}={long id with a hashtag at the end}; expires={7 days}; path=/; HttpOnly
And the script looks like this:
Well, this is new...
Doing requests
Every API request requires two headers:
Surprisingly enough, we can get the OLD info fields from another API request called "context", which gives us all the stuff, even the stupid "isArtystyczna13", etc...
The request looks like this:
GET -
https://dziennik-uczen.vulcan.net.pl/{symbol}/api/Context(just our typical cookies from the website, no appguid or requestverificationtoken)
For things in the API that are fetched at the panel itself, it doesn't use the key, but in fetching grades, etc. it does.
An example is "PlanZajecTablica":
GET -
https://dziennik-uczen.vulcan.net.pl/{symbol}/api/PlanZajecTablica?key={key from context}I will continue research / dropping more info in the thread below - along with API requests that I have access to
This is actually very similar to how the previous LoginType things (ADFS, etc.) do it, but with some extra requests needed to be done to get the same amount of information that is used in every day SDK usage.
As far as I know, this system does not support the HEBE api (no dostep mobilny) which means that this is the only way of integrating it with the SDK. :/