使用 post 请求和 xsrf 令牌登录，但收到 419

Question

我正在尝试使用 pythons requests 库登录 slicethepie.com。

根据我的理解，我收到 419 是因为我没有传递 csrf 令牌。我在 Chrome 网络选项卡中看到的唯一类似令牌是 XSRF-TOKEN。 我需要通过它吗？为什么我的代码返回 419？

您当前可以看到我正在 cookie 中传递 XSRF 令牌，但运气不佳。

import requests

link = "https://www.slicethepie.com/login"
response = requests.get(link)  # no XSRF token in here

payload = { "email": "private", "password": "private", "_token": "private", "validation": "token", location[latitude]: None, location[longitude]: None}

headers = {
    "Cookie": "XSRF-TOKEN=...slicethepie_session=...",
    "Accept": "*/*",
    "Accept-Encoding": "gzip, deflate, br",
    "Connection": "keep-alive",
    "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36",
    "Referer": "https://www.slicethepie.com/login",
    "Origin": "https://www.slicethepie.com",
}

with requests.Session() as s:
    p = s.post(
        "https://www.slicethepie.com/login",
        headers=headers,
        json=payload,
    )
    print(p) # returns 419. Page Expired

有效负载中的表单数据

_token: private
_token: private
validation: token
location[latitude]: None
location[longitude]: None
email: private
password: private