bilibili-qr-login

repository·main·Indexed 17 days ago

https://github.com/wittf/bilibili-qr-login

A tool for acquiring Bilibili cookies via QR code scanning. It supports embedded login via iframe or window modes, programmatic access through a RESTful API for converting cookies to JSON/TinyDB format, and TV mode for obtaining specific Token authentication. The service includes security features like TRUST_ORIGIN whitelisting and postMessage communication for integration into web applications.

Tokens
9.4K
Snippets
26
Records
42
Agent score
63%

What's inside bilibili-qr-login

  1. Overview of Bilibili QR Login features

    main

    Bilibili QR Login is a tool designed to quickly acquire Bilibili (B站) Cookies via QR code scanning. Key features include:

    • QR Code Login: Scan to log in to Bilibili accounts.
    • Cookie Acquisition: Automatically retrieves login information.
    • Cookie Conversion: Converts Cookies to JSON/TinyDB format.
    • RESTful API: Supports programmatic access to conversion services.
    • TV Login Support: Supports scanning via the 'Cloud Vision Small TV' (云视听小电视) App to obtain TV-specific Token authentication.
    • Embedding Support: Compatible with iframe and window modes for integration into other web applications.
    • Multi-language & Themes: Supports multiple languages (CN, EN, JP, etc.) and system/manual dark/light modes.
  2. Core features of the Bilibili login service

    main

    The service provides three primary capabilities for developers:

    1. Embedded Login: Supports two modes for embedding the login interface: iframe and window.
    2. Cookie Conversion: Automatically converts Bilibili Cookies into a standardized JSON format.
    3. Message Communication: Uses postMessage to securely transmit login results between the service and your application.
  3. Configure cross-origin security for postMessage

    main

    To prevent unauthorized domains from receiving login data, you can configure security via server-side environment variables or client-side URL parameters.

    1. Server-side: TRUST_ORIGIN Environment Variable

    Use this to define a whitelist of allowed domains on the server.

    ValueDescription
    *Allows all domains (Default for development).
    "" (empty)Only allows the same domain (Default for production).
    https://app.comAllows a single specific domain.
    https://a.com,https://b.comAllows multiple domains, comma-separated.

    2. Client-side: targetOrigin URL Parameter

    Explicitly specify the target origin in the login URL.

    https://login.bilibili.bi/?mode=iframe&targetOrigin=https://yourdomain.com

    Security Behavior Matrix

    TRUST_ORIGIN ConfigtargetOrigin ParamResult
    *Any value✅ Allowed
    https://app.comhttps://app.com✅ Allowed
    https://app.comhttps://evil.com❌ Downgraded to whitelist (not sent to evil.com)
    Not configuredAny value✅ Allowed
    Not configuredNot specified✅ Automatically detects parent domain

    Security Recommendation: In production, always configure a specific TRUST_ORIGIN whitelist and avoid using *.

    // Example of dynamically setting targetOrigin to the current window origin
    const loginUrl = 'https://login.bilibili.bi/?mode=iframe&targetOrigin=' + 
                     encodeURIComponent(window.location.origin);
  4. Integrate Bilibili QR Login into other websites

    main
    The project supports embedded login integration via iframe or window modes. Communication between the embedded instance and your host site is handled via postMessage. When embedded, the tool includes built-in security features such as validation and displaying the target destination of the Cookie to ensure reliability.
  5. Use TV mode for additional token information

    main

    The login service provides a TV mode which can be toggled via the UI (clicking the TV icon).

    When logging in via TV mode, the returned Cookie string includes additional authentication tokens that are not present in standard Web mode:

    FieldDescription
    access_tokenTV access token
    refresh_tokenRefresh token
    midUser ID
    expires_inExpiration time in seconds

    postMessage Format

    The postMessage structure remains identical to Web mode; only the content of the data field changes to include the extra tokens.

    Example data string: SESSDATA=xxx; bili_jct=yyy; DedeUserID=123; access_token=abc; refresh_token=def; mid=456; expires_in=7776000

  6. Deploy Bilibili QR Login locally

    main

    To run the Bilibili Cookie acquisition tool on your own machine, clone the repository and use yarn to install dependencies and start the service. By default, the service runs on localhost:3000.

    # 克隆仓库
    git clone https://github.com/WittF/bilibili-qr-login.git
    
    # 进入项目目录
    cd bilibili-qr-login
    
    # 运行项目
    yarn install
    yarn start
  7. Explore demo implementation examples

    main

    The demo/ directory contains several implementation templates for different environments:

    • example.html: A full integration example demonstrating embedded login and JSON conversion.
    • basic.html: A minimal implementation using standard HTML and JavaScript.
    • json-convert-example.html: A specialized demonstration of the JSON conversion API.
    • vue-example.vue: An example of integrating the service into a Vue 3 application.
    • react-example.jsx: An example of integrating the service into a React application.
    • API.md: The authoritative API documentation containing request/response formats and field definitions.
  8. Configure Outbound Proxies for Bilibili access

    main

    If the server needs to access Bilibili through a proxy, use standard proxy environment variables. These affect only the server's outbound requests to Bilibili, not how client IPs are detected.

    Priority Order for HTTPS requests:

    1. https_proxy / HTTPS_PROXY
    2. http_proxy / HTTP_PROXY
    3. all_proxy / ALL_PROXY
    4. Direct connection

    Note: Lowercase variable names (e.g., https_proxy) take precedence over uppercase ones.

    Supported Protocols: http://, https://, socks5://, socks5h:// (where socks5h ensures DNS resolution happens at the proxy side).

    # HTTP proxy with credentials
    https_proxy=http://user:pass@127.0.0.1:7890
    
    # SOCKS5 proxy
    https_proxy=socks5://127.0.0.1:1080
    
    # Fallback proxy
    all_proxy=socks5://127.0.0.1:1080
    
    # Exclude specific hosts from proxying
    no_proxy=localhost,127.0.0.1,.internal
  9. Deploy Bilibili QR Login via Docker

    main

    You can deploy the service using Docker by pulling the official image and running a container. Map port 3000 to access the service.

    # 拉取镜像
    docker pull wittf/bilibili-qr-login:latest
    
    # 运行容器
    docker run -d \
      --name bili-qrlogin \
      -p 3000:3000 \
      wittf/bili-qrlogin:latest
  10. Integrate embedded Bilibili login via iframe or window

    main

    You can integrate Bilibili login functionality into your application using an iframe or a popup window. The base URL for the login service is https://login.bilibili.bi/.

    URL Parameters

    ParameterTypeRequiredDescriptionExample
    modestringNoLogin mode: iframe or window?mode=iframe
    langstringNoInterface language (default: zh-CN)?lang=en
    themestringNoTheme mode: light, dark, or auto (default: auto)?theme=dark
    targetOriginstringNoManually specify the postMessage target domain?targetOrigin=https://app.com

    Theme Options

    • light: Forces light theme.
    • dark: Forces dark theme.
    • auto: Follows system theme settings (default).

    Example URLs

    • iframe + English + Dark Theme: https://login.bilibili.bi/?mode=iframe&lang=en&theme=dark
    • Popup + Light Theme: https://login.bilibili.bi/?mode=window&theme=light
    • iframe + Specific Target Domain: https://login.bilibili.bi/?mode=iframe&targetOrigin=https://app.com
    https://login.bilibili.bi/?mode=iframe&lang=en&theme=dark
  11. Run the demo examples locally

    main

    To view the integration examples and see how the Bilibili login service works, you can run the local development server and open the provided HTML files. This requires having yarn installed.

    1. Start the local development server from the project root.
    2. Open the demo/example.html file in your browser to see the integrated login and JSON conversion features.
    # 启动本地服务器
    yarn dev
    
    # 打开示例页面
    open demo/example.html
  12. Configure Reverse Proxy and Client IP detection

    main

    To ensure the service correctly identifies the real client IP when behind a reverse proxy (like Nginx or Cloudflare), configure TRUSTED_PROXIES and TRUSTED_PROXY_HEADERS.

    • TRUSTED_PROXIES: A comma-separated list of trusted proxy IPs or IPv4 CIDRs. If empty, the service uses legacy behavior (reading common headers unconditionally).
    • TRUSTED_PROXY_HEADERS: The specific headers to read for the client IP (e.g., X-Forwarded-For).

    Common Scenarios:

    • Nginx Reverse Proxy: TRUSTED_PROXIES="127.0.0.1,10.0.0.0/8" TRUSTED_PROXY_HEADERS="X-Forwarded-For,X-Real-IP"

    • Cloudflare: Use Cloudflare's official IPv4 CIDR list and set the header to CF-Connecting-IP. TRUSTED_PROXIES="<Cloudflare CIDRs>" TRUSTED_PROXY_HEADERS="CF-Connecting-IP"

    • Loose Configuration (Not recommended for production): TRUSTED_PROXIES="*"

    # Example for Nginx reverse proxy
    TRUSTED_PROXIES="127.0.0.1,10.0.0.0/8"
    TRUSTED_PROXY_HEADERS="X-Forwarded-For,X-Real-IP"