WebSocket debugging in Javascript app gives "401 Unauthorized" [closed]

Question

I'm attempting to reverse engineer a private API used by an Android app that makes use of WebSockets. These requests are made from JavaScript inside a WebView.

I use Charles to intercept both HTTP and WebSocket requests, with it I'm able to see how the app successfully connects and speaks to the API with WebSockets. The API uses cookies to authorize connections, the cookies responsible for it are "ts.default" and "ts.default.sig".

This is how the request looks in Charles:

My goal is to be able to speak with the API from a Python script. However, when making the same Upgrade request, making sure to keep all relevant headers, I get a 401 Unauthorized status code:

I've uploaded the relevant JavaScript code responsible for such requests here.

I'm not very proficient with WebSockets and seeing how I've been stuck here for the past few hours I thought maybe someone here could be able to spot what I'm missing.

Answer 1

Ok, I figured it out. The websocket-client library I use for python writes its own Origin header by default and I was ending up with two Origin headers, which may have been tipping off the server.

I found out you can disable it by adding supress_origin=True when calling connect on the WebSocket.