Missing cookie SESSONID

[lmerhay]

Hi, I have been using MiScale Exporter on Android for a while now, without any issues, however recently, whenever I am trying to upload data to Garmin, I get a "Missing cookie SESSIONID" message and the upload fails.
Is this a known issue? Can you pls let me know if you need any more specific info?
Thanks!

[lswiderski]

Hi @lmerhay !

Thanks for the report. I have the same error and it looks like Garmin has changed something in the way I log in. I'll look into it today to investigate.

[lmerhay]

Hi Łukasz, not sure if that helps to track the issue, but I also get an error message from the web app (too many requests). So yeah, something may have changed on Garmin’s end. From: Łukasz Świderski ***@***.***> Sent: Tuesday, September 26, 2023 7:26 AM To: lswiderski/mi-scale-exporter ***@***.***> Cc: lmerhay ***@***.***>; Mention ***@***.***> Subject: Re: [lswiderski/mi-scale-exporter] Missing cookie SESSONID (Issue #20) Hi @lmerhay <https://github.com/lmerhay> ! Thanks for the report. I have the same error and it looks like Garmin has changed something in the way I log in. I'll look into it today to investigate. — Reply to this email directly, view it on GitHub <#20 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKE7CIPVPGMCLIUKD65FOOTX4JRN7ANCNFSM6AAAAAA5HCAZGE> . You are receiving this because you were mentioned. <https://github.com/notifications/beacon/AKE7CINNXSSGLOZZIUUY4ATX4JRN7A5CNFSM6AAAAAA5HCAZGGWGG33NNVSW45C7OR4XAZNMJFZXG5LFINXW23LFNZ2KUY3PNVWWK3TUL5UWJTTHM66TQ.gif> Message ID: ***@***.*** ***@***.***> >

[lswiderski]

Status for today:
It looks like most of the open source 3rd party apps that connect to Garmin stopped working.

My findings:
Any action now require Authorization Bearer JWT Token, new Cookie JWT_FGP=, new Header Di-Backend: connectapi.garmin.com

the JWT Token can be obtained under https://connect.garmin.com/modern/di-oauth/exchange it require 3 Cookies: __cflb=, notice_behavior=implied,eu;, SESSIONID=. In response header I also receive JWT_FGP Cookie

[lswiderski]

pe-st/garmin-connect-export#95

[SimonBaars]

I implemented a solution for this problem in related Python repositories:

• Use a Garth OAuth implementation fixes #95 pe-st/garmin-connect-export#96
• Migrate to new auth flow and use Garth, fixes #103 petergardfjall/garminexport#104
• Migrate Garmin authentication to Garth OAuth fixes #128 jaroslawhartman/withings-sync#129

Since I don't know much about this repo, I don't know what exact auth method is used, but I figure a similar solution could work.

[lswiderski]

@SimonBaars Thanks! I will check for sure, although I can't use Garth directly because of the project language (c#) I will reimplement the same flow

[lswiderski]

Status update: With library OAuth.DotNetCore I received proper oAuth1 token. I will do more tests during the weekend.

[lswiderski]

Progress update:
Login and upload of activity (weight) works already works as external lib. Now it's time to test it in Android.

https://github.com/lswiderski/GarminWeightScaleUploader/blob/master/Libs/garmin-connect-client/GarminConnectClient.Lib/Services/Client.cs

[jesuslg123]

Progress update: Login and upload of activity (weight) works already works as external lib. Now it's time to test it in Android.

https://github.com/lswiderski/GarminWeightScaleUploader/blob/master/Libs/garmin-connect-client/GarminConnectClient.Lib/Services/Client.cs

Thanks! if you can provide the APK I could give it a try in Android.

[lswiderski]

Ok I fixed the App. It works on an emulator and my phone. Package was sent to Google Play Store to check and certificate and should be available to update within 24h.

.AAB and .APK installers are available here https://github.com/lswiderski/mi-scale-exporter/releases/tag/v2.0.8

@jesuslg123 Please check.

Any confirmation or bug report is welcome.

[jesuslg123]

Progress update: Login and upload of activity (weight) works already works as external lib. Now it's time to test it in Android.
https://github.com/lswiderski/GarminWeightScaleUploader/blob/master/Libs/garmin-connect-client/GarminConnectClient.Lib/Services/Client.cs

Thanks! if you can provide the APK I could give it a try in Android.

I don't have the scale now but I did try to upload the data from previous days and this morning and it is failing with 3 different errors, one after each attempt.

Any idea?

[lswiderski]

Thank you. I need to work on more detailed logs. Error about expected pattern means that Garmin somehow did not authenticated you. Do you have MFA/2FA turned off? What version of Android do you use? The weight did not uploaded in background?

[jesuslg123]

Thanks for the support. Something interesting happened. I did restart the phone and worked fine this time.

May the Google play version kept running some service when I did remove to install the GitHub version?

Now works uploading manually. Automatically with the scale I can not test right now, sorry

[lswiderski]

Thank you. On Scale part nothing changed so should work fine. In near future I will add some retry policy to it because I can see it can don't work randomly.

Anyway I'm happy We won with Garmin and connection is working Again.

[SirYaro]

In my case, I was able to send weight alone. When other values are present, I'm getting the same message as @jesuslg123 on 2nd and 3rd screenshot.

I tried resend like... 20 times. I'm persistent... :P

[SirYaro]

Tbh I don't think this issue is resolved... :(

[lswiderski]

@SirYaro Ohh I will investigate more

[lswiderski]

@SirYaro I got the same error when I'm back to opened app. When I closed (kill) and opened again, stand on scale, get measurement and uploaded with success.

[SirYaro]

Yup. 9/10 it works like that. Which is okay-ish...? :)

I also noticed that I'm able to send data only one time. If I hit "send" second, third etc time (with different data and day) I'm getting this:

[lswiderski]

For now I must be ok :/ In free time, I will rewrite the Garmin Connect part. But it will take some time. I wanted to release the fix asap even if it's not perfect.

[SimonBaars]

404 sounds as if it is trying to reach out to a URL unauthenticated. The new method only works for oauth2 authenticated endpoints, not for scraping webpages.
@lswiderski Do you have a list of Garmin URLs that the app tries to access?

[lswiderski]

@SimonBaars The problem was with the way of use of the Garmin client. Everytime when upload is done, method is trying to authenticate the user. On the second time, the auth headers was already there and the initial url was returning 404 (https://connect.garmin.com/modern/auth/hostname). Hotfixed it in 2.0.9 by clearing the headers of the http client.

[lswiderski]

As I can see on version 2.0.9 I don't have that problems anymore, So I'm closing this issue.