Gestione dell'autenticazione degli utenti

Many websites require you to log in to access certain data or features. Bots often need to simulate this process to get past paywalls, access dashboards, or retrieve personalized content.

• Access restricted content.
• Perform user-specific actions.
• Maintain a persistent identity.

When you log in manually, your browser sends your username and password to the server. This is usually done via an HTTP POST request to a specific URL.

• POST request: Sends data securely in the request body.
• Form fields: Input fields for credentials (e.g., username, password).
• Action URL: The server endpoint that processes the login.

To automate a login, you need to identify the form's action URL and the name attributes of the input fields (username, password). Browser developer tools are essential here.

• Right-click on the login form → "Inspect".
• Look for the <form> tag: find its action attribute.
• Look for <input> tags: find their name attributes for credentials.

The Python requests library can send POST requests. You'll prepare a dictionary of your credentials and pass it to requests.post().

• The dictionary keys should match the input field name attributes.
• The values will be your username and password.
• The url will be the form's action URL.

Here's a simple example of trying to log in. Note that without session management, you'll likely be logged out immediately after the request, as no cookies are persisted.

After a successful login, websites typically send back a cookie. This small piece of data is stored by your browser and sent with subsequent requests, telling the server you're still logged in.

• Session: A continuous interaction between a user and a website.
• Cookies: Small text files used by websites to remember information about you.
• Crucial for maintaining a logged-in state across multiple page visits.

The requests library has a Session object that automatically handles cookies for you. Once you log in using a Session object, it will include the authentication cookies in all subsequent requests made through that same session.

• Create a session object: s = requests.Session().
• Use s.post() for login and s.get() for subsequent requests.
• No need to manually manage cookies.

This example demonstrates how to use requests.Session() to maintain your logged-in state. After logging in, the session object automatically includes the cookies for the subsequent GET request.

How do you know if your bot actually logged in successfully? It's crucial to verify the outcome.

• Status Code: A 200 OK often means success, but sometimes redirects happen (e.g., 302 Found).
• Redirects: Check response.history to see if you were redirected to a dashboard or profile page.
• Page Content: Look for specific text that only appears when logged in (e.g., "Welcome, [username]", a "Logout" button, or absence of login form).

In this lesson, we learned how to build bots that can log into websites to access protected content.

• We covered inspecting login forms to find the action URL and input field names.
• We used requests.post() to send credentials.
• Most importantly, we learned to use requests.Session() to manage and persist cookies, allowing our bots to stay logged in and access authenticated content.
• Finally, we discussed how to verify successful logins by checking status codes, redirects, and page content.