From 8395b946f8e0849d2cd14ac3a5bae8d4e8e6c290 Mon Sep 17 00:00:00 2001 From: Brandon Thomas Date: Fri, 17 Oct 2025 14:17:33 -0400 Subject: [PATCH] notes --- .../listen_websocket/metadata/chrome_curl.txt | 44 ++++++++++++++++++- 1 file changed, 43 insertions(+), 1 deletion(-) diff --git a/crates/api_clients/grok_client/src/requests/listen_websocket/metadata/chrome_curl.txt b/crates/api_clients/grok_client/src/requests/listen_websocket/metadata/chrome_curl.txt index e7c6d9965d..2753e919bb 100644 --- a/crates/api_clients/grok_client/src/requests/listen_websocket/metadata/chrome_curl.txt +++ b/crates/api_clients/grok_client/src/requests/listen_websocket/metadata/chrome_curl.txt @@ -25,4 +25,46 @@ curl --include \ --header "Origin: https://grok.com" \ --header "Sec-WebSocket-Key: SGVsbG8sIHdvcmxkIQ==" \ --header "Sec-WebSocket-Version: 13" \ - "https://grok.com/ws/imagine/listen" \ No newline at end of file + "https://grok.com/ws/imagine/listen" + +------------------------------------------- + +This turns a 401 into a 400 - it's a mix of: + + - the above SO answer + - "copy as curl" from Chrome" + - curl-impersonate: + +curl-impersonate-chrome -vvv 'wss://grok.com/ws/imagine/listen' \ + --include \ + --no-buffer \ + -H 'Connection: Upgrade' \ + -H 'Upgrade: websocket' \ + -H 'Host: grok.com' \ + -H 'Origin: https://grok.com' \ + -H 'Sec-WebSocket-Key: XjPVg9OQe7CJOH6U7lq5vw==' \ + -H 'Sec-WebSocket-Version: 13' \ + -b '_ga=GA1.1.1232202746.1760710013; i18nextLng=en; sso=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzZXNzaW9uX2lkIjoiOGU3MDFiNzctOTdkNC00ZjM0LWExOTctOWFmMDU1MzY3NDAwIn0.-a6x0InxbGzfTVfUlrdzxskxCnvMDI8lC90z4wHeGIk; sso-rw=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzZXNzaW9uX2lkIjoiOGU3MDFiNzctOTdkNC00ZjM0LWExOTctOWFmMDU1MzY3NDAwIn0.-a6x0InxbGzfTVfUlrdzxskxCnvMDI8lC90z4wHeGIk; stblid=b3331fc1-45d7-466b-83df-67427c0b2367; mp_ea93da913ddb66b6372b89d97b1029ac_mixpanel=%7B%22distinct_id%22%3A%2285980643-ffab-4984-a3de-59a608c47d7f%22%2C%22%24device_id%22%3A%2279ce237a-a0f3-4913-bf4b-519ac8a98263%22%2C%22%24initial_referrer%22%3A%22%24direct%22%2C%22%24initial_referring_domain%22%3A%22%24direct%22%2C%22__mps%22%3A%7B%7D%2C%22__mpso%22%3A%7B%7D%2C%22__mpus%22%3A%7B%7D%2C%22__mpa%22%3A%7B%7D%2C%22__mpu%22%3A%7B%7D%2C%22__mpr%22%3A%5B%5D%2C%22__mpap%22%3A%5B%5D%2C%22%24user_id%22%3A%2285980643-ffab-4984-a3de-59a608c47d7f%22%7D; cf_clearance=e7.LXFbmc.U81rZIqxuBfBe88yuBZMXEP.zwxNkbOxw-1760724394-1.2.1.1-JMHrapBGxcZriUw852.NCqwFRpZJFvoYxq.mV0jDpKCkiHBZwpdv09XJi6eFLJUYJJ6UDZ3c1eAsucVYLdWN.SvA9M6qzujj8nY4ym03PxQlMEd2OmXJogtDDJbPhA5AZEGxA39_6QQlvaBIUBnYPALYrTl9XJN_V4q3n4BXtpoBzrIJURMIn0mW3esUCGv0NukuVQrkrNtMgqT5SUmTGi0idaBYoR_2_wv4P09lsug; _ga_8FEWB057YH=GS2.1.s1760724394$o3$g1$t1760724401$j53$l0$h0' \ + -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36' + + > Sec-WebSocket-Version: 13 + > User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36 + > + * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): + * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4): + * old SSL session ID is stale, removing + < HTTP/1.1 400 Bad Request + < Date: Fri, 17 Oct 2025 18:15:29 GMT + < Content-Length: 0 + < Connection: keep-alive + < speculation-rules: "/cdn-cgi/speculation" + < Server: cloudflare + < CF-RAY: 9901c814add7452d-ATL + * Refused WebSockets upgrade: 400 + * Closing connection 0 + * TLSv1.3 (OUT), TLS alert, close notify (256): + curl: (22) Refused WebSockets upgrade: 400 + +Removing the cookie turns it into a Cloudflare 401. + +