fix(protonvpn): use legacy API for updater authentication#3274
Open
zrclshn wants to merge 1 commit intoqdm12:masterfrom
Open
fix(protonvpn): use legacy API for updater authentication#3274zrclshn wants to merge 1 commit intoqdm12:masterfrom
zrclshn wants to merge 1 commit intoqdm12:masterfrom
Conversation
Proton's account.proton.me API now requires a session/CAPTCHA flow (POST /auth/v4/sessions returns 8004 "Operation not allowed") that blocks automated access from server environments. Switch the ProtonVPN updater to use the legacy api.protonvpn.ch endpoint which supports direct SRP authentication without the session dance. Also update version.go to fetch app version tags from ProtonVPN/proton-vpn-gtk-app instead of ProtonMail/WebClients, as proton-account tags are no longer published there.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
account.proton.meAPI now requires a session/CAPTCHA flow that blocks automated access fromserver environments (
POST /auth/v4/sessionsreturns code 8004 "Operation not allowed")api.protonvpn.chendpoint which supports direct SRPauthentication without the session dance
version.goto fetch app version tags fromProtonVPN/proton-vpn-gtk-appinstead ofProtonMail/WebClients, asproton-accounttags are no longer published thereContext
When running
gluetun update -maintainer -allwith ProtonVPN credentials, the updater fails at theunauthenticated session creation step:
ERROR getting protonvpn servers: authentifying with Proton: getting unauthenticated session data:
HTTP status code not OK: Unprocessable Entity: Operation not allowed (code 8004 with details: )
This happens because Proton now enforces human verification (CAPTCHA) on the
account.proton.me/api/auth/v4/sessionsendpoint for programmatic requests. The legacyapi.protonvpn.chendpoint still accepts direct SRP auth (
/auth/info+/auth) without requiring a session, so the fixswitches to that flow.
The
version.gochange is related:ProtonMail/WebClientsno longer publishesproton-account@tags (thelatest tags are
proton-vpn-settings@), causing the app version lookup to fail. Switching toProtonVPN/proton-vpn-gtk-apptags and usinglinux-vpn@as the app version prefix resolves this. (Note:the
protonvpn-more-serversbranch already has a similar version.go fix.)Test plan
LogicalServersdata structure