IndexError: list index out of range

[slapin95]

Hello,

Installed on Win10 with python 3.12 I had to modify the requirements.txt to set lxml to 5.1.0 but not a gig deal
Google API is set up and the credentials.json is working with a quickstart project.
Here it is asking for ifit.com account and the crash.... Sorry Yes I have a nordiktrack bike.

Thanks for your help.

C:\Users\franc\GIT\ifitsync>python ifitsync.py
iFit Username(email):
SomeAccount
Password:
Traceback (most recent call last):
File "C:\Users\franc\GIT\ifitsync\ifitsync.py", line 2, in
from get_ifitaccount import HISTORY_JSON, IFIT_HIST_HEADERS
File "C:\Users\franc\GIT\ifitsync\get_ifitaccount.py", line 101, in
CLIENT_ID = clientid_list[0]
~~~~~~~~~~~~~^^^
IndexError: list index out of range

[omriasta]

It appears that this is tied to lxml since it's not returning proper list of application credentials.
You may want to try this with a virtual environment on an older version of Python.

[slapin95]

no luck on a brand new debian 12 with lxml 4.9.2 exact same message.
What OS & Python have you used?
Just to narrow the investigation
Thanks

[omriasta]

I have it running on raspbian and python 3.7.3.
It could also be a change on the ifit website.
Try to go to https://www.ifit.com/settings/apps
And view source in your browser. Then search for clientid. You should have a list of client IDs and secrets. That is all the script is actually doing, it's grabbing one of the existing client IDs and secrets and then authenticating as if it was that app. Once it does this once, it just refreshes the token after that. So it could be that they are now hiding this or that they changed the url.

[slapin95]

I guess that's it.
I do not have any app on ifit.com. I guess it is because now you have to pay to connect app.

[omriasta]

You don't need to have any app connected. They actually use an app to sync data from your bike to the website and the phone app. But I do believe you need an ifit membership to have access to any of that.

[omriasta]

It's definitely the website that changed, just took a look and the items I was scraping aren't there anymore.
How well versed are you with python?

[triplepoint]

Picking this up, it looks like the client ID and secret aren't in the source for https://www.ifit.com/settings/connected-apps at all. There's an element in that initialState variable you're looking for named "clientsAndTokens", but it's an empty object. I guess they stripped all the actual API call usage out of the web app, and require a mobile app now? Any idea where else we can find the secret/key pair?

[omriasta]

The only other suggestion I have which I am also unsure if it still works is to install an android virtual machine using an extremely old version (before certificate pinning) then use a proxy to listen to the traffic from the app when you sign in. I did this before I found the client id and secret in the website....I'll try and look tomorrow if I remember or have the old virtual machine somewhere to give you more details.

[triplepoint]

Ah, right on. Thanks for looking into it.

[omriasta]

OK, so after a refresh of my memory from a long time ago, I used genymotion (which is free for desktop) to install android 6.0 (before certificate pinning). Then I installed the app store separately as well. Besides that, you will need to install "Charles Proxy" and configure the android VM to use the proxy. Then you should be able to see the traffic being sent when you login to the ifit app and grab the client id and secret. Though this was many many years ago, so not sure it still works. I did notice in "clientsandokens' on the website now, they have an entry for the "wolf-onboarding-webview" . This is what I used to see as well when I first used genymotion. I am guessing that the clientid is there, just not sure if there is a way to get the client secret from there.