From 07615acbb0220404bc6bee84514f83a1268efbc8 Mon Sep 17 00:00:00 2001 From: GodfreyPrince Date: Sat, 5 Sep 2026 13:03:09 +0530 Subject: [PATCH] Fetch homepage authenticated for ClientTransaction init The logged-out x.com homepage no longer embeds the ondemand chunk map or loading-x-anim frames that xclienttransaction parses, so the anonymous fetch in _ensure_client_transaction always failed init and no x-client-transaction-id header was ever generated. The search endpoint rejects such requests with HTTP 404 even with a fresh live queryId, while feed/user endpoints kept working. Send the account Cookie + X-Csrf-Token with the init fetch so the logged-in page (which contains all three markers) is parsed instead. --- twitter_cli/client.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/twitter_cli/client.py b/twitter_cli/client.py index 0436c8e..0f6f220 100644 --- a/twitter_cli/client.py +++ b/twitter_cli/client.py @@ -1103,6 +1103,15 @@ def _ensure_client_transaction(self): # a different TLS fingerprint on the same IP — a detection vector. cffi_session = _get_cffi_session() ct_headers = _gen_ct_headers() + # Fetch the homepage authenticated: the logged-out page no + # longer embeds the ondemand chunk map / loading-x-anim frames + # that transaction-ID generation parses, so an anonymous fetch + # always fails init and search requests go out without the + # x-client-transaction-id header (HTTP 404). + ct_headers["Cookie"] = self._cookie_string or ( + "auth_token=%s; ct0=%s" % (self._auth_token, self._ct0) + ) + ct_headers["X-Csrf-Token"] = self._ct0 home_page = cffi_session.get( "https://x.com", headers=ct_headers, timeout=10, )