Repository navigation
Fix authentication redirects while preserving signed requests - #603
Merged
Merged
Conversation
majd
enabled auto-merge (rebase)
October 1, 2026 16:37
rxliuli
added a commit
to rxliuli/AppDowngrader
that referenced
this pull request
Oct 20, 2026
Login failed with "apple returned no usable authentication response (HTTP 301): missing account credentials..." even with correct credentials. The bundled ipatool v2.6.0 only accepts HTTP 302 as the Store pod redirect and does not retry 301/403, while Apple's auth edge intermittently redirects or rejects POST .../MZFinance.woa/wa/authenticate (known upstream: majd/ipatool#598 and #520). - upgrade Sources/bin/ipatool 2.6.0 -> 2.7.0 (universal x86_64 + arm64, checksums verified against the published sha256sums). v2.7.0 normalizes the auth endpoint to the trailing-slash form and handles 301/302/307/308 redirects plus 403 retries (majd/ipatool#603). - parse ipatool output line by line: it emits one JSON record per line, so decoding the whole stream always failed and the login sheet showed raw log lines (info line included) in red. - do not revoke the existing session before login: a transient Apple edge failure then turned into a logout of a previously working session. ipatool overwrites the stored account on success anyway. The CLI flags the app relies on are unchanged in 2.7.0, and the SAP runtime (Unicorn 2.1.4) is identical, so entitlements and the bundled binary signing step need no changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Authentication can fail on HTTP 301 redirects or authentication URLs with trailing slashes. Handle 301, 302, 307, and 308 redirects explicitly, accept both authentication path forms, and preserve signed POST payloads, cookies, and 2FA codes.
Validate redirect destinations, limit redirect chains, preserve credential attempt numbers, and add sanitized redirect diagnostics and regression coverage.