From ad2ff3a7b6ffdfcd48ad072a4b6ccc81a479d3bb Mon Sep 17 00:00:00 2001 From: superdooper86 Date: Mon, 11 May 2026 10:35:30 +0200 Subject: [PATCH] fix: revert to URL-based auth detection; remove browser headers MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Every JS/cookie-based detection approach failed. Reverting to the simplest reliable mechanism: if the WebView navigates to any non-login, non-auth URL, the server redirected us after sign-in — fire onAuthenticated. Also removing the browser headers added in beta.6. The 1.1.4 version worked without them and they may be triggering server-side bot detection. All-cookies approach (beta.8) is kept. --- ClaudeChecker/Info.plist | 4 ++-- ClaudeChecker/LoginView.swift | 27 +++++++-------------------- ClaudeChecker/UsageViewModel.swift | 8 +------- 3 files changed, 10 insertions(+), 29 deletions(-) diff --git a/ClaudeChecker/Info.plist b/ClaudeChecker/Info.plist index 38ee5fd..7bac4ed 100644 --- a/ClaudeChecker/Info.plist +++ b/ClaudeChecker/Info.plist @@ -15,9 +15,9 @@ CFBundlePackageType APPL CFBundleShortVersionString - 1.2.1-beta.9 + 1.2.1-beta.10 CFBundleVersion - 57 + 58 LSMinimumSystemVersion 13.0 LSUIElement diff --git a/ClaudeChecker/LoginView.swift b/ClaudeChecker/LoginView.swift index 9b73520..49ede14 100644 --- a/ClaudeChecker/LoginView.swift +++ b/ClaudeChecker/LoginView.swift @@ -32,26 +32,13 @@ struct LoginWebView: NSViewRepresentable { func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) { guard !didAuthenticate else { return } - // Don't fire on the login/auth pages themselves - if let url = webView.url?.absoluteString, - url.contains("/login") || url.contains("/auth") { return } - - // Ask the WebView itself whether we're authenticated — it uses its own - // session (cookies, localStorage, etc.) so we don't need to know the - // cookie domain or name. - webView.callAsyncJavaScript( - "const r = await fetch('/api/bootstrap', {credentials: 'include'}); return r.status;", - arguments: [:], in: nil, in: .page - ) { [weak self] result in - guard let self, !self.didAuthenticate else { return } - // JS numbers arrive as NSNumber (Double-backed), not Swift Int - if case .success(let val) = result, - let n = val as? NSNumber, n.intValue == 200 { - self.didAuthenticate = true - DispatchQueue.main.asyncAfter(deadline: .now() + 0.3) { - self.onAuthenticated() - } - } + guard let url = webView.url?.absoluteString else { return } + // Stay on login/auth pages — user hasn't completed sign-in yet + if url.contains("/login") || url.contains("/auth") { return } + // Navigated away from login — server redirected us, so sign-in completed + didAuthenticate = true + DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { + self.onAuthenticated() } } } diff --git a/ClaudeChecker/UsageViewModel.swift b/ClaudeChecker/UsageViewModel.swift index 9ab091d..8b96d14 100644 --- a/ClaudeChecker/UsageViewModel.swift +++ b/ClaudeChecker/UsageViewModel.swift @@ -130,13 +130,7 @@ class UsageViewModel: ObservableObject { private func claudeAPIRequest(for url: URL) async -> URLRequest { var req = URLRequest(url: url) - req.setValue("application/json, text/plain, */*", forHTTPHeaderField: "accept") - req.setValue("Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36", forHTTPHeaderField: "User-Agent") - req.setValue("https://claude.ai", forHTTPHeaderField: "Origin") - req.setValue("https://claude.ai/", forHTTPHeaderField: "Referer") - req.setValue("same-origin", forHTTPHeaderField: "sec-fetch-site") - req.setValue("cors", forHTTPHeaderField: "sec-fetch-mode") - req.setValue("empty", forHTTPHeaderField: "sec-fetch-dest") + req.setValue("application/json", forHTTPHeaderField: "accept") if let cookie = await claudeCookieHeader() { req.setValue(cookie, forHTTPHeaderField: "Cookie") }