Making the api of migros more accessible to the public
Home Page: https://github.com/Aliyss/migros-api-wrapper
License: MIT License
I tried accessing the API with public data of the website, but was not able to get all the necessary cookies. I realized that the app will need to send all of the required cookies to function, thus decrypted the requests.
I used <REDACTED> to indicate values that I omitted due to privacy reasons.
Using PCAPdroid I was able to decrypt the apps requests and payloads.
Using GET https://mobile-app.migros.ch/app/products/receipts/<REDACTED> HTTP/2.0
with headers
authorization: Bearer <REDACTED>
x-app-build: 439
x-app-ecom-toggle: true
x-app-migros-tracking-id: <REDACTED>
x-siren-version: 1
x-app-famigros-loyalty: false
x-app-cumulus-number: <REDACTED>
x-route-version: 2
x-app-migros-cooperative: national
x-app-login-id: <REDACTED>
x-feature-flags: receipts-all-types, receipts-cumulus-points, maat-inline-html, discounts-detail-entity, discounts-productlistholder, mgo-push-registration, maat-teaser-embed-webviews, maat-link-embed-webviews, cmdI was able to retrieve the reciept
{
"class": [
"product.list"
],
"properties": {
"title": "Gekaufte Produkte",
"subtitle": "<REDACTED (DATE OF PURCHASE)> – M Märt Shop Ville Zürich HB",
"disclaimer": "Es werden nur aktuell verfügbare Produkte angezeigt.",
"tracking": {
"screenName": "productlist/receipt",
"campaignParent": ""
},
"scoresAvailable": true,
"type": "products"
},
"entities": [
{
"class": [
"product.list.section"
],
"properties": {
"id": "BeSS_010113",
"name": "Fertiggerichte, Menüs & Snacks",
"description": "Fertiggerichte, Menüs & Snacks"
},
"entities": [
{
"class": [
"product.thumbnail"
],
"properties": {
"meta": {
"isOwg": false
},
"id": "130447000000",
"texts": {
"price": "5.95",
"originalPrice": "",
"priceShoppingList": "CHF 5.95",
"originalPriceShoppingList": "",
"name": "V-Love Sandwich Bacon Style",
"subtext": "200g",
"description": "",
"status": ""
},
"accessibleTexts": {
"price": "5 Franken 95 Rappen",
"originalPrice": ""
},
"price": {
"current": 5.95,
"original": 0,
"points": 0,
"varies": false
},
"styles": {
"subtext": []
},
"status": {
"likes": 0
},
"category": {
"id": "BeSS_010113",
"name": "Fertiggerichte, Menüs & Snacks",
"sortOrder": 23
}
},
"entities": [
{
"class": [
"image"
],
"properties": {},
"entities": [],
"actions": [],
"links": [
{
"rel": [
"self"
],
"href": "//image.migros.ch/xxhdpi_pi_list/4a67b9bf6126c2e6f775a6fb32ab463908b99164/v-love-sandwich-bacon-style.jpg"
}
]
}
],
"actions": [
{
"name": "product.actions.addtoshoppinglist",
"href": "https://mobile-app.migros.ch/app/shoppinglist/:id/product/130447000000"
},
{
"name": "product.detail.actions.like",
"method": "PUT",
"href": "https://mobile-app.migros.ch/app/products/id/130447000000/user/like",
"type": "application/json"
},
{
"name": "product.detail.actions.dislike",
"method": "DELETE",
"href": "https://mobile-app.migros.ch/app/products/id/130447000000/user/like",
"type": "application/json"
}
],
"links": [
{
"rel": [
"self"
],
"href": "https://mobile-app.migros.ch/app/products/id/130447000000"
},
{
"rel": [
"hybrid"
],
"href": "https://hybrid-app.migros.ch/products/130447000000",
"headers": {
"accept-language": "de",
"x-app-migros-cooperative": "national",
"x-app-version": "",
"x-app-build": "439",
"x-device-id": "",
"x-device-uuid": "",
"x-device-os": "ios",
"x-device-os-version": "Unknown"
}
}
]
}
],
"actions": [],
"links": []
}
],
"actions": [],
"links": [
{
"rel": [
"self"
],
"href": "https://mobile-app.migros.ch/discovery/products/receipts/20230921_155602_0150140_257_403"
},
{
"rel": [
"ratings"
],
"href": "https://mobile-app.migros.ch/app/products/ratings?ids=130447000000"
}
]
}To get a list of reciepts we can use https://mobile-app.migros.ch/order/receipts/list/2024-01-01 to get
{
"class": [
"receipt.list"
],
"properties": {},
"entities": [
{
"class": [
"receipt.thumbnail"
],
"properties": {
"id": "<REDACTED>",
"timestamp": "<REDACTED>+02:00",
"storeName": "M Märt Shop Ville Zürich HB",
"totalAmount": "5.95",
"preciseTotalAmount": 595,
"accessibilityLabel": "Kassenbon vom Montag, <REDACTED> in M Märt Shop Ville Zürich HB, 5 Franken 95 Rappen ausgegeben, 5.95 Punkte gesammelt",
"cumulusPoints": "5.95",
"preciseCumulusPoints": 595
},
"entities": [],
"actions": [],
"links": [
{
"rel": [
"html"
],
"href": "https://mobile-app.migros.ch/app/receipts/<REDACTED>/html"
},
{
"rel": [
"products"
],
"href": "https://mobile-app.migros.ch/app/products/receipts/<REDACTED>"
}
]
},
{
"class": [
"receipt.thumbnail"
],
"properties": {
"id": "<REDACTED>",
"timestamp": "<REDACTED>+02:00",
"storeName": "M Märt Shop Ville Zürich HB",
"totalAmount": "5.95",
"preciseTotalAmount": 595,
"accessibilityLabel": "Kassenbon vom Donnerstag, <REDACTED> in M Märt Shop Ville Zürich HB, 5 Franken 95 Rappen ausgegeben, 5.95 Punkte gesammelt",
"cumulusPoints": "5.95",
"preciseCumulusPoints": 595
},
"entities": [],
"actions": [],
"links": [
{
"rel": [
"html"
],
"href": "https://mobile-app.migros.ch/app/receipts/<REDACTED>/html"
},
{
"rel": [
"products"
],
"href": "https://mobile-app.migros.ch/app/products/receipts/<REDACTED>"
}
]
}
],
"actions": [],
"links": []
}The app-login-id seems to be the most important cookie. I'm not sure if this alone might be enough to access at least some data. It is noteworthy that this cookie is very short lived (couple of minutes). There are other cookies necessary to renew it every so often. This makes the whole approach very cumbersome and not usable for any real-world use for now. If we can figure out the renewal process, it might be a easy way to access the API.
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.