AWS WAF / Fantastic Fiction

[kiwidude]

Hi,

Anyone using the Fantastic Fiction plugin will know that it has been "broken" for a while now thanks to the website requiring an aws-waf-token cookie, which is generated as part of you visiting the website as a user. This is an AWS protection service they sell to vendors (yet Amazon ironically do not use themselves, they want their own data to be scraped within reason). There is all sorts of cleverness behind this to make it extremely difficult to bypass, combine that with the constraints of what can be realistically packaged in a metadata plugin and you are left with a very difficult problem to crack.

The "temporary" workaround I put in place with a special build of the FF plugin was a configuration box allowing the user to paste in their cookie value manually from their browser dev tools. Horrible UX but at least it works - for a few days until your cookie expires and you have to do it again.

The only idea I can come up with as a slight improvement on this would be to write a browser extension to make that passing back of the cookie a more user friendly experience. The crude option would be to just have it copy to the clipboard, the advanced version would have it send the data back to an http port in a calibre plugin. So on the configure page for the plugin there could be a button which would launch a FF url in your browser and ask the user to click the browser extension toolbar button. When performing a metadata download it could check that token value for its expiry and log out a message telling them they need to open their Configuration page for the plugin and repeat the exercise.

This is all pretty nasty but the only idea I can come up with. The challenges still left I see:
- Would calibre "let" me from a config page in a metadata plugin open an http port for the extension to talk back to? Or do I just go the simple route of relying on the clipboard.
- Informing the user they need to install a browser extension.
- Supporting the various browsers - Chromium-based vs Firefox
- Will the Extensions marketplaces even allow such a plugin to exist / pass their security rules.

Which leads to the question of is it worth bothering with at all?

Thoughts on a postcard - if the consensus is "no" then I will just deprecate the plugin.

[BetterRed]

Originally Posted by kiwidude

- Supporting the various browsers - Chromium-based vs Firefox

You could require users who's default browser is not Chromium-based to make use of this tweak to use a Chromium-based browser for calibre.



BR