403 status code discussion

[Smoki-Cool]

Not sure why but it's still not working for me. To be more specific, the first get request itself is failing and not returning a 200 code. So the cookie fix is not really helping since I get a 403 error code in the first attempt to connect to the base_url

[Smoki-Cool]

@Fedee0 sorry for the ping, but do you have any idea? Could I have your code snippet that works perhaps?

[Fedee0]

@Fedee0 sorry for the ping, but do you have any idea? Could I have your code snippet that works perhaps?

i'll try the new version too and let you know

[Giglium]

Vinted may be blocking traffic from certain VPNs or cloud providers, which could be causing the issue.

To verify if this is the case, you can run the following curl command:

curl -v -c - -L "https://www.vinted.co.uk/"

If you see < HTTP/2 403 and also in the cookie section you don't see the added cookie access_token_web =. Otherwise, the access_token_web will be found in the added cookie section and there is a problem with this package.

I've tested the quickstart from my workstation and also from the GitHub action during the release of version 2.3.1: https://github.com/Giglium/vinted_scraper/actions/runs/11591093540 and, thanks to @Fedee0 fix its works.

Can you try the code on your workstation before pushing it to the cloud? Can you add a minimal reproducible example to the issue?

[Fedee0]

@Smoki-Cool I confirm that updating to 2.3.1 works for me, did you actually update?

[lucalenardi]

Hello everyone,
first of all, thank you for this library! I'm trying to use vinted_scraper to scrape data from Vinted (particularly the catalog/items endpoint) and running into issues with Cloudflare challenges and session cookies.

Here’s what I’ve tried so far:

1. Let vinted_scraper fetch the session cookie automatically (_vinted_fr_session and access_token_web ) from https://www.vinted.it.
   • I always end up with an error similar to “Cannot fetch session cookie from https://www.vinted.it/, status code: none, or no _vinted_fr_session found.”
2. Manually supplying session_cookie taken from the browser (where I have _vinted_fr_session, access_token_web, and sometimes cf_clearance), which temporarily works but expires quickly.
3. I noticed there is also a refresh_token_web, but I haven’t found any official or documented way to programmatically refresh the session.

Result each time:

• Sometimes I get a Cloudflare challenge page (HTML “please wait” or 403 if it’s a captcha).
• Other times I get 401 with “Jeton d’authentification invalide” unless I manually copy fresh tokens.
• The tokens I do get (from the browser) expire, and since I can’t see how the library might handle refresh_token_web, I keep having to regenerate them.

Question:
Is there a recommended approach for automatically renewing the session or handling Cloudflare challenges within vinted_scraper? For example, can we feed a refresh_token_web to the library, or is there an endpoint we can call that vinted_scraper might support?
Any guidance (or example usage) on dealing with short-lived tokens would be extremely helpful.

Using version 2.3.1.

Thanks!

[Giglium]

Thanks for your analysis, @lucalenardi. Unfortunately, we don't have any documentation on how to do it or how we can integrate the refresh_token_web. To deal with the expired refresh token I tried to fetch it again but if the package could not fetch the refresh token it's unuseful and you have to manually do it.

[Giglium]

Hi @Smoki-Cool,
@lucalenardi found a bug in the fetch_cookie logic. Is version 2.3.2 working for you now?

[lucalenardi]

Hello!

I'm encountering new issues with Vinted's request limits. It seems that I cannot make more than a certain number of calls to "item" per hour (200?). However, "search" does not appear to be limited in the same way.

Are you getting the same limitaiton?

Additionally, using a proxy for _curl calls results in SSL verification errors, which I suspect may be related to the quality or features of the proxy itself. It should be possible to set SSL verification to False when instantiating the scraper to allow proxy usage if needed.

Would it be possible to introduce an option to disable SSL verification when using a proxy?

Thanks!

[Giglium]

Hi @lucalenardi,
for the request limit yes. Normally I perform one "search" and an X "item" call so for me it's normal to get the error on the "item" API call but I never investigated.

Sure, from the doc we can disable SSL verification: https://docs.python-requests.org/en/latest/user/advanced/#ssl-cert-verification. I will add it this weekend! Please open another issue to keep track of the development.

[Fedee0]

Hey there, im the only one failing to fetch consistently the cookies? Maybe its related to the SSL verification? Should i turn it off?

[Giglium]

Hi @Fedee0,
The SSL verification should be turned off if you use some proxy otherwise I see no reason.

If you downgrade to 2.3.1 it still failing? Can you attack a stack trace or an error?