Adding headers to get around Incapsula WAF#140
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hello @pyro2927, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!
Summary of Changes
This pull request addresses issue #139 by adding headers to bypass the Incapsula WAF (Web Application Firewall). The changes involve modifying the api.py file to include a set of default headers and incorporating these headers into the API requests. Specifically, a _headers dictionary is added to the __init__ method of the API class, containing User-Agent, Accept, Accept-Language, Accept-Encoding, and Connection headers. These headers are then included in the get_endpoint, login, and submit_form methods when making API requests.
Highlights
- Header Injection: The pull request introduces a
_headersdictionary to the API class, which includes common headers used by web browsers. This is done to circumvent the Incapsula WAF. - API Request Modification: The
get_endpoint,login, andsubmit_formmethods are modified to include the_headersdictionary when making API requests. This ensures that the requests include the necessary headers to bypass the WAF. - CSRF Token Handling: The code ensures that the CSRF token, if available, is included in the headers for the
get_endpointmethod.
Changelog
- custom_components/generac/api.py
- Added a
_headersdictionary to the__init__method, containing default headers. - Modified the
get_endpointmethod to include the_headersdictionary in the API requests. Lines 89-91 were changed to lines 96-102. - Modified the
loginmethod to include the_headersdictionary in the API requests. Lines 111-114 were changed to lines 123-128. - Modified the
loginmethod to include the_headersdictionary in the POST request toSelfAsserted. Lines 139-143 were changed to lines 155-160. - Modified the
loginmethod to include the_headersdictionary in the GET request toconfirmed. Lines 160-163 were changed to lines 177-181. - Modified the
submit_formmethod to include the_headersdictionary in the POST request. Lines 197-200 were changed to lines 215-218.
- Added a
Using Gemini Code Assist
The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.
Invoking Gemini
You can request assistance from Gemini at any point in your pull request via creating an issue comment (i.e. comment on the pull request page) using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands.
| Feature | Command | Description |
|---|---|---|
| Code Review | /gemini review |
Performs a code review for the current pull request in its current state. |
| Pull Request Summary | /gemini summary |
Provides a summary of the current pull request in its current state. |
| Comment | @gemini-code-assist | Responds in comments when explicitly tagged, both in issue comments and review comments. |
| Help | /gemini help |
Displays a list of available commands. |
Customization
To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.
Limitations & Feedback
Gemini Code Assist is currently in preview and may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments to provide feedback.
You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.
A WAF stands in the way,
Headers are sent to save the day.
Bypassing the gate,
To communicate,
So data can flow without delay.
Footnotes
-
Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩
There was a problem hiding this comment.
Code Review
This pull request adds headers to the API client to potentially bypass the Incapsula WAF. The changes seem reasonable and address the reported issue. However, there are a few points to consider regarding security and maintainability.
Summary of Findings
- Hardcoded User-Agent: The User-Agent string is hardcoded. While this might work, it's not ideal for maintainability and could be easily detected by the WAF in the future. Consider making it configurable or using a more dynamic approach.
- Header Management: The code duplicates header creation logic in multiple functions. It would be better to have a single function to manage headers and add CSRF token if available.
Merge Readiness
The pull request addresses the reported issue and seems to be working as intended. However, the hardcoded User-Agent and duplicated header creation logic should be addressed before merging. I am unable to directly approve this pull request, and recommend that others review and approve this code before merging.
|
Hey @pyro2927, thanks for the PR against this old repo. A community member applied it against my maintained fork of the repo and v0.3.6 has now been published via HACS with the fix in place. We credited your PR in the API code alongside the new headers. |
## Summary Implemented JWT Bearer token authentication as a third authentication method alongside existing username/password and browser cookies options. This resolves recaptcha issues by using the mobile app's direct API authentication. ## Mobile App Analysis - Analyzed Generac iOS app traffic using Charles Proxy - Discovered mobile app uses /api/v5/Apparatus/list endpoint - Found JWT Bearer token authentication with Azure B2C - Mobile User-Agent: mobilelink/75633 CFNetwork/3826.600.41 Darwin/24.6.0 ## Changes Made - **const.py**: Added auth method constants and configuration fields - **api.py**: Enhanced GeneracApiClient to support JWT tokens with mobile headers - **config_flow.py**: Added multi-step config flow with auth method selection - **__init__.py**: Updated client initialization for all auth methods - **CLAUDE.md**: Documented mobile app analysis and implementation ## Authentication Methods 1. **Username/Password** - Original web login (has recaptcha issues) 2. **Browser Cookies** - Manual extraction from web session 3. **JWT Token** - Mobile app token for direct API access (recommended) ## Charles Proxy Setup for JWT Token Extraction To extract your own JWT token from the Generac mobile app: 1. **Install Charles Proxy certificate on iOS device** - Download Charles root certificate on device - Install via Settings > General > VPN & Device Management - Trust certificate in Settings > General > About > Certificate Trust Settings 2. **Configure Charles for SSL Proxying** - Add *.mobilelinkgen.com to SSL Proxying locations - Add *.generacconnectivity.b2clogin.com to SSL Proxying locations 3. **Capture mobile authentication** - Clear Generac app data/logout completely - Start Charles recording - Login to Generac mobile app - Stop recording 4. **Extract JWT token** - Find requests to app.mobilelinkgen.com - Look for Authorization header: Bearer eyJhbGciOiJSUzI1NiIs... - Copy the full JWT token (after "Bearer ") ## API Improvements - Added v5 API endpoint support with v2 fallback - Enhanced error handling for different auth methods - Mobile app compatible headers and User-Agent 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
## Summary
Enhanced Home Assistant plugin to use Generac mobile app's v5 API endpoints
with expanded sensor support and property type mapping updates. Maintains
backward compatibility with v2/v1 APIs.
## v5 API Integration
- **Apparatus List**: GET /api/v5/Apparatus/list with v2 fallback
- **Apparatus Details**: GET /api/v5/Apparatus/{id} with v1 fallback
- **Enhanced Data Models**: Added v5-specific fields for alerts, maintenance, alarms
- **Property Type Remapping**: Updated type mappings for v5 compatibility
## New Sensors Added
### Regular Sensors
- **Exercise Minutes** (type 95) - Generator exercise duration in minutes
- **Fuel Type** (type 88) - Natural Gas/Propane/Unknown detection
- **Network Type** - WiFi/Ethernet connection method
- **Current Alarm** - Active alarm codes from v5 API
### Binary Sensors
- **Service Mode** - Service mode enabled status
- **VPP Enrolled** - Virtual Power Plant enrollment status
- **Active VPP Event** - VPP event active status
- **Disconnected Notifications** - Notification settings enabled
## Property Type Mapping Updates
Based on v5 API JSON analysis:
- **Battery Voltage**: v5 type 70 (was v2 type 69)
- **Engine Hours**: v5 type 71 (was v2 type 70)
- **Hours of Protection**: v5 type 32 (was v2 type 31)
- **Exercise Minutes**: v5 type 95 (new)
- **Fuel Type**: v5 type 88 (new)
## Backward Compatibility
- All sensors check v5 property types first, then fallback to v2 types
- API endpoints fallback from v5 → v2 → v1 as needed
- Existing installations continue working with original endpoints
## Data Model Enhancements
- Added Alert, Maintenance, and nested Snmp data classes
- Enhanced ApparatusDetail with v5-specific fields:
- networkType, serviceModeEnabled, alarmEcodeLabel
- alert, currentAlarm, alarms, maintenance, warnings
- tuProperties, disconnectedNotification
## Files Modified
- **api.py**: v5 endpoint integration with fallbacks
- **models.py**: Enhanced data models for v5 API structure
- **sensor.py**: Property type mapping updates + new sensors
- **binary_sensor.py**: New binary sensors for v5 boolean fields
- **CLAUDE.md**: Updated documentation with v5 implementation
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
…y types
## Change Summary
Reverted apparatus details endpoint from v5 back to v1 for better reliability
while maintaining the updated property type mappings for v5 compatibility.
## API Endpoint Changes
- **Apparatus List**: Still uses /api/v5/Apparatus/list (working well)
- **Apparatus Details**: Back to /api/v1/Apparatus/details/{id} (more stable)
## Property Types Maintained
Keeping v5 property type mappings with v2 fallbacks:
- Battery Voltage: v5 type 70 (fallback to v2 type 69)
- Engine Hours: v5 type 71 (fallback to v2 type 70)
- Hours of Protection: v5 type 32 (fallback to v2 type 31)
- Exercise Minutes: v5 type 95 (new)
- Fuel Type: v5 type 88 (new)
## Rationale
- v5 apparatus list provides newer data structure
- v1 apparatus details endpoint is more reliable/consistent
- Property type mappings handle data format differences
- Best of both worlds: new data + stable endpoints
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
2 participants
Fixes #139. Adds headers to get around Incapsula WAF. Confirmed working in my local install.