I put it out here because it took me a lot of time and analysis of the network interaction to find this answer...
I had to login to a swagger/openAPI with python/requests. I could login to the site with a browser, but to login with requests I would need the x_csrf_token/sails.sid
combo...
After trying and failing all answers here and otherwhere, checked the browser communication. It turns out the only way was to first get the 'sails.sid', and then do a GET to the undocumented(?) /csrfToken...
base_host = '...'
base_path= '/api/v2'
base_url = base_host + base_path
data = {
"email": "...",
"password": "..."
}
resp = requests.post(f"{base_url}/login", data=data)
session_cookie = resp.cookies
session_dict=session_cookie.get_dict()
sails_sid = session_dict.get('sails.sid','could not get valid [sails.sid]')
print(f'sails.sid:{[sails_sid]}')
Then:
cookies = {
'sails.sid': sails_sid,
}
headers = {
'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:100.0) Gecko/20100101 Firefox/100.0',
}
r2 = requests.get(f"{base_url}/csrfToken", cookies=cookies, headers=headers)
print(r2.json())
Notice that in my case it was emai/password... I found all this from analysing the browser via Firefox inspect, so that might be your last option too...