friloo/Unifi-Voucher-Tool
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 16

Fix HTTP 403 on login: add Origin and Referer headers

Browse source 
UniFi OS enforces CSRF protection on the login endpoint itself and
returns 403 if Origin/Referer headers are absent, regardless of whether
the credentials are correct. Required headers:
  Origin: https://controller:port
  Referer: https://controller:port/login

Documented in Art-of-WiFi UniFi-API-client reference implementation.

https://claude.ai/code/session_01UsuvFAmmeagtQa14QA4iaq
This commit is contained in:
Claude 2026-04-22 05:28:17 +00:00
parent 7fdf156f5f
commit 78a2b41329
No known key found for this signature in database
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
includes/UniFiController.php
View file

@ -38,7 +38,11 @@ class UniFiController {
CURLOPT_COOKIEFILE => $this->cookieFile, CURLOPT_COOKIEFILE => $this->cookieFile,
CURLOPT_TIMEOUT => 10, CURLOPT_TIMEOUT => 10,
CURLOPT_CONNECTTIMEOUT => 5, CURLOPT_CONNECTTIMEOUT => 5,
CURLOPT_HTTPHEADER => ['Content-Type: application/json'], CURLOPT_HTTPHEADER => [
'Content-Type: application/json',
'Origin: ' . $this->controllerUrl,
'Referer: ' . $this->controllerUrl . '/login',
],
CURLOPT_HEADERFUNCTION => function($ch, $header) { CURLOPT_HEADERFUNCTION => function($ch, $header) {
$parts = explode(':', $header, 2); $parts = explode(':', $header, 2);
if (count($parts) === 2) { if (count($parts) === 2) {