From 362fa1c44e5993ea350cb6b444de88367b21b478 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20S=C3=A1nchez?= <johansanchezal@unimagdalena.edu.co>
Date: Fri, 12 Jun 2026 10:46:11 -0500
Subject: [PATCH 1/3] HttpFetcher has been improved to avoid WAF detection.
 Integration tests for HttpFetcher and TiktokClient.

---
 .../Clients/TiktokClient.cs                   |  2 +-
 .../Fetchers/HttpFetcher.cs                   | 31 +++++++----------
 .../Options/HttpFetcherOptions.cs             |  3 +-
 TiktokExplode.IntegrationTests/Usings.cs      |  5 ++-
 .../Videos/HttpFetcherTests.cs                | 33 +++++++++++++++++++
 .../Videos/TiktokClientTests.cs               | 27 +++++++++++++++
 6 files changed, 78 insertions(+), 23 deletions(-)
 create mode 100644 TiktokExplode.IntegrationTests/Videos/HttpFetcherTests.cs
 create mode 100644 TiktokExplode.IntegrationTests/Videos/TiktokClientTests.cs

diff --git a/TiktokExplode.Infrastructure/Clients/TiktokClient.cs b/TiktokExplode.Infrastructure/Clients/TiktokClient.cs
index d7c6552..087d04c 100644
--- a/TiktokExplode.Infrastructure/Clients/TiktokClient.cs
+++ b/TiktokExplode.Infrastructure/Clients/TiktokClient.cs
@@ -52,7 +52,7 @@ public async Task<Video> GetVideoAsync(string url, CancellationToken cancellatio
                 _downloadClient.InjectCookies(result.Cookies);
                 return await _parser.ParseAsync(result.HtmlContent);
             }
-            catch (TiktokWafException) when (attempt < options.MaxWafRetries)
+            catch (TiktokException) when (attempt < options.MaxWafRetries)
             {
                 await Task.Delay(options.RetryBaseDelay * (attempt + 1), cancellationToken);
             }
diff --git a/TiktokExplode.Infrastructure/Fetchers/HttpFetcher.cs b/TiktokExplode.Infrastructure/Fetchers/HttpFetcher.cs
index f6918b3..db1c492 100644
--- a/TiktokExplode.Infrastructure/Fetchers/HttpFetcher.cs
+++ b/TiktokExplode.Infrastructure/Fetchers/HttpFetcher.cs
@@ -58,7 +58,7 @@ public HttpFetcher(HttpFetcherOptions options)
 
             MaxConnectionsPerServer = 10,
 
-            EnableMultipleHttp2Connections = true
+            EnableMultipleHttp2Connections = true,
         };
 
         _httpClient = new HttpClient(_handler);
@@ -79,18 +79,10 @@ private void ConfigureDefaultHeaders()
 
         headers.Clear();
 
-        headers.TryAddWithoutValidation("User-Agent",                _options.UserAgent);
-        headers.TryAddWithoutValidation("Accept",                    "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8");
-        headers.TryAddWithoutValidation("Accept-Language",           "en-US,en;q=0.9");
-        headers.TryAddWithoutValidation("Accept-Encoding",           "gzip, deflate, br");
-        headers.TryAddWithoutValidation("Upgrade-Insecure-Requests", "1");
-        headers.TryAddWithoutValidation("Sec-Fetch-Dest",            "document");
-        headers.TryAddWithoutValidation("Sec-Fetch-Mode",            "navigate");
-        headers.TryAddWithoutValidation("Sec-Fetch-Site",            "none");
-        headers.TryAddWithoutValidation("Sec-Fetch-User",            "?1");
-        headers.TryAddWithoutValidation("sec-ch-ua",                 "\"Chromium\";v=\"136\", \"Google Chrome\";v=\"136\", \"Not.A/Brand\";v=\"99\"");
-        headers.TryAddWithoutValidation("sec-ch-ua-mobile",          "?0");
-        headers.TryAddWithoutValidation("sec-ch-ua-platform",        "\"Windows\"");
+        headers.TryAddWithoutValidation("User-Agent", _options.UserAgent);
+        headers.TryAddWithoutValidation("Accept", "*/*");
+        headers.TryAddWithoutValidation("Cache-Control", "no-cache");
+        headers.TryAddWithoutValidation("Connection", "keep-alive");
     }
 
     /// <summary>
@@ -107,12 +99,10 @@ public async Task<PageFetchResult> FetchPageAsync(string url, CancellationToken
 
         using var request = new HttpRequestMessage(HttpMethod.Get, url)
         {
-            Version = HttpVersion.Version20,
-            VersionPolicy = HttpVersionPolicy.RequestVersionOrLower
+            Version = HttpVersion.Version11,
+            VersionPolicy = HttpVersionPolicy.RequestVersionExact
         };
 
-        request.Headers.Referrer = new Uri("https://www.tiktok.com/");
-
         using var response = await _httpClient.SendAsync(
             request,
             HttpCompletionOption.ResponseHeadersRead,
@@ -123,6 +113,9 @@ public async Task<PageFetchResult> FetchPageAsync(string url, CancellationToken
         if (content.Contains("_wafchallengeid", StringComparison.OrdinalIgnoreCase))
             throw new TiktokWafException("TikTok WAF challenge detected.");
 
+        if (!content.Contains("__UNIVERSAL_DATA_FOR_REHYDRATION__", StringComparison.OrdinalIgnoreCase))
+            throw new TiktokException("TikTok logo detected.");
+
         var cookies = _cookies.GetAllCookies()
             .Cast<Cookie>()
             .Select(c => new CookieData
@@ -157,8 +150,8 @@ private async Task EnsureWarmedUpAsync(CancellationToken cancellationToken)
 
             using var request = new HttpRequestMessage(HttpMethod.Get, "https://www.tiktok.com/")
             {
-                Version = HttpVersion.Version20,
-                VersionPolicy = HttpVersionPolicy.RequestVersionOrLower
+                Version = HttpVersion.Version11,
+                VersionPolicy = HttpVersionPolicy.RequestVersionExact
             };
 
             using var response = await _httpClient.SendAsync(
diff --git a/TiktokExplode.Infrastructure/Options/HttpFetcherOptions.cs b/TiktokExplode.Infrastructure/Options/HttpFetcherOptions.cs
index 2fa9896..06dd044 100644
--- a/TiktokExplode.Infrastructure/Options/HttpFetcherOptions.cs
+++ b/TiktokExplode.Infrastructure/Options/HttpFetcherOptions.cs
@@ -15,7 +15,6 @@ public sealed class HttpFetcherOptions
 
     /// <summary>
     /// The <c>User-Agent</c> header value sent with all HTTP requests.
-    /// Defaults to a recent Chrome on Windows UA string.
     /// </summary>
-    public string UserAgent { get; set; } = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36";
+    public string UserAgent { get; set; } = "TikTokExplode/1.2.0";
 }
diff --git a/TiktokExplode.IntegrationTests/Usings.cs b/TiktokExplode.IntegrationTests/Usings.cs
index fa76cd1..1e6efcd 100644
--- a/TiktokExplode.IntegrationTests/Usings.cs
+++ b/TiktokExplode.IntegrationTests/Usings.cs
@@ -3,4 +3,7 @@
 global using System.Text.Json.Nodes;
 global using TiktokExplode.Infrastructure.Fetchers.Search;
 global using TiktokExplode.IntegrationTests.Fixtures;
-global using TiktokExplode.Infrastructure.Clients;
\ No newline at end of file
+global using TiktokExplode.Infrastructure.Clients;
+global using TiktokExplode.Infrastructure.Fetchers;
+global using TiktokExplode.Domain.Exceptions;
+global using TiktokExplode.Infrastructure.Options;
\ No newline at end of file
diff --git a/TiktokExplode.IntegrationTests/Videos/HttpFetcherTests.cs b/TiktokExplode.IntegrationTests/Videos/HttpFetcherTests.cs
new file mode 100644
index 0000000..b3da553
--- /dev/null
+++ b/TiktokExplode.IntegrationTests/Videos/HttpFetcherTests.cs
@@ -0,0 +1,33 @@
+namespace TiktokExplode.IntegrationTests.Videos;
+
+public sealed class HttpFetcherTests
+{
+    [Fact]
+    public async Task FetchPageAsync_Should_Bypass_Waf_And_Return_Page_Content()
+    {
+        // Arrange
+        using var fetcher = new HttpFetcher();
+
+        // Act
+        Func<Task> act = async () =>
+        {
+            var result = await fetcher.FetchPageAsync(
+                "https://www.tiktok.com/@js_nightwave/video/7579504710961548565");
+
+            // Assert
+            result.Should().NotBeNull();
+
+            result.HtmlContent.Should().NotBeNullOrWhiteSpace();
+
+            result.HtmlContent.Should()
+                .NotContain("_wafchallengeid");
+
+            result.HtmlContent.Length.Should().BeGreaterThan(10_000);
+
+            result.Cookies.Should().NotBeEmpty();
+        };
+
+        // Assert
+        await act.Should().NotThrowAsync<TiktokWafException>();
+    }
+}
diff --git a/TiktokExplode.IntegrationTests/Videos/TiktokClientTests.cs b/TiktokExplode.IntegrationTests/Videos/TiktokClientTests.cs
new file mode 100644
index 0000000..58764f6
--- /dev/null
+++ b/TiktokExplode.IntegrationTests/Videos/TiktokClientTests.cs
@@ -0,0 +1,27 @@
+namespace TiktokExplode.IntegrationTests.Videos;
+
+public sealed class TiktokClientTests
+{
+    [Fact]
+    public async Task GetVideoAsync_Should_Return_Video()
+    {
+        var options = new TiktokOptions
+        {
+            MaxWafRetries = 10,
+            RetryBaseDelay = TimeSpan.FromMilliseconds(200),
+        };
+
+        await using var client = TiktokClient.CreateWithHttp(options: options);
+
+        var video = await client.GetVideoAsync(
+            "https://www.tiktok.com/@js_nightwave/video/7579504710961548565");
+
+        video.Should().NotBeNull();
+
+        video.Id.Should().NotBeNullOrWhiteSpace();
+
+        video.Info.DownloadLinks.Should().NotBeNull();
+
+        video.Author.Should().NotBeNull();
+    }
+}

From 1133da050b7f1dd681369c8e8454a5f8534f2788 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20S=C3=A1nchez?= <johansanchezal@unimagdalena.edu.co>
Date: Fri, 12 Jun 2026 10:49:03 -0500
Subject: [PATCH 2/3] The target version has been changed to 1.2.1

---
 TiktokExplode.All/TiktokExplode.All.csproj                      | 2 +-
 .../TiktokExplode.Infrastructure.csproj                         | 2 +-
 TiktokExplode/TiktokExplode.csproj                              | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/TiktokExplode.All/TiktokExplode.All.csproj b/TiktokExplode.All/TiktokExplode.All.csproj
index 763b0c4..52be5ad 100644
--- a/TiktokExplode.All/TiktokExplode.All.csproj
+++ b/TiktokExplode.All/TiktokExplode.All.csproj
@@ -10,7 +10,7 @@
 
   <PropertyGroup>
     <PackageId>TiktokExplode.All</PackageId>
-    <Version>1.2.0</Version>
+    <Version>1.2.1</Version>
     <Authors>Ts-Pytham</Authors>
     <Owners>Ts-Pytham</Owners>
     <Description>Meta-package that installs TiktokExplode (domain layer) and TiktokExplode.Infrastructure (HTTP/browser fetchers, parser, download client) in a single command.</Description>
diff --git a/TiktokExplode.Infrastructure/TiktokExplode.Infrastructure.csproj b/TiktokExplode.Infrastructure/TiktokExplode.Infrastructure.csproj
index d26eba5..33f596a 100644
--- a/TiktokExplode.Infrastructure/TiktokExplode.Infrastructure.csproj
+++ b/TiktokExplode.Infrastructure/TiktokExplode.Infrastructure.csproj
@@ -12,7 +12,7 @@
 
   <PropertyGroup>
     <PackageId>TiktokExplode.Infrastructure</PackageId>
-    <Version>1.2.0</Version>
+    <Version>1.2.1</Version>
     <Authors>Ts-Pytham</Authors>
     <Owners>Ts-Pytham</Owners>
     <Description>Infrastructure layer for TiktokExplode: HTTP and Playwright-based page fetchers, TikTok video parser, CDN download client, and WAF-retry logic.</Description>
diff --git a/TiktokExplode/TiktokExplode.csproj b/TiktokExplode/TiktokExplode.csproj
index 44620ea..f723a82 100644
--- a/TiktokExplode/TiktokExplode.csproj
+++ b/TiktokExplode/TiktokExplode.csproj
@@ -11,7 +11,7 @@
 
   <PropertyGroup>
     <PackageId>TiktokExplode</PackageId>
-    <Version>1.2.0</Version>
+    <Version>1.2.1</Version>
     <Authors>Ts-Pytham</Authors>
     <Owners>Ts-Pytham</Owners>
     <Description>Domain layer for TiktokExplode: strongly-typed models, interfaces, and utilities for working with TikTok video metadata. Zero external dependencies.</Description>

From 38b7d547e084bd517f4d10785af7faf670489c64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20S=C3=A1nchez?= <johansanchezal@unimagdalena.edu.co>
Date: Fri, 12 Jun 2026 10:59:40 -0500
Subject: [PATCH 3/3] new unit test

---
 .../Clients/TiktokClientTests.cs              | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/TiktokExplode.Tests/Infrastructure/Clients/TiktokClientTests.cs b/TiktokExplode.Tests/Infrastructure/Clients/TiktokClientTests.cs
index fe97f0d..3d80716 100644
--- a/TiktokExplode.Tests/Infrastructure/Clients/TiktokClientTests.cs
+++ b/TiktokExplode.Tests/Infrastructure/Clients/TiktokClientTests.cs
@@ -47,6 +47,25 @@ public async Task Should_RetryAndSucceed_When_FetcherThrowsWafOnFirstAttemptOnly
         await fetcher.Received(2).FetchPageAsync(ValidUrl, Arg.Any<CancellationToken>());
     }
 
+    [Fact]
+    public async Task Should_RetryAndSucceed_When_First_Attempt_Fails()
+    {
+        var fetcher = Substitute.For<IPageFetcher>();
+        var options = new TiktokOptions { MaxWafRetries = 2, RetryBaseDelay = TimeSpan.Zero };
+
+        fetcher.FetchPageAsync(Arg.Any<string>(), Arg.Any<CancellationToken>())
+               .Returns(
+                   Task.FromException<PageFetchResult>(new TiktokException()),
+                   Task.FromResult(TikTokFixtures.ValidVideoResult)
+               );
+
+        await using var client = new TiktokClient(fetcher, options);
+
+        var video = await client.GetVideoAsync(ValidUrl);
+
+        video.Should().NotBeNull();
+    }
+
     [Fact]
     public async Task Should_ThrowTiktokWafException_When_AllRetriesAreExhausted()
     {