All Requests are Failing with "Request Failed with status 400 - Bad Request" Even with Updated Key #233

BigThunderSR · 2023-09-27T19:35:25Z

All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in #232 does not seem to make a difference.

Maliron · 2023-09-27T23:32:21Z

Why are they SOOO upset that we can interface with their API faster than the terrible MyGMC/Chevrolet app? The apps are so incredibly slow, it is so much faster to bring is all in to HomeAssistant and use that for remote starting and such. We seem to lose access to the API every couple weeks though. This really sucks.

Do we know if this is them shutting us out of the API or simply them changing it? I believe the API is not officially documented or open and this was all reverse engineered right?

LightningManGTS · 2023-09-28T02:35:34Z

I started doing the homeassitant > node red implementation myself because of gm dropping support for google home (big thanks Bigthundersr by the way). The least they can do is not be insufferable about their API access when their own web developers can't code their website to unhide authenticator elements properly.

tbclark3 · 2023-09-28T18:47:21Z

Why are they SOOO upset that we can interface with their API faster than the terrible MyGMC/Chevrolet app? The apps are so incredibly slow, it is so much faster to bring is all in to HomeAssistant and use that for remote starting and such. We seem to lose access to the API every couple weeks though. This really sucks.

I also like the API being faster, but it's so much more than that. Integrating into Home Assistant lets me issue a warning if we arm the security system at night while the car is still plugged in (don't want it to catch fire while we're asleep) or early in the morning if I forgot to charge it. It sends me an email to put air in the tires if needed. I'm on my second Bolt, but if GM doesn't want me to use the API, I will switch to a different brand when my lease is up in a couple of months.

BennyDaBee · 2023-09-30T20:34:34Z

@joelvandal @coelho I know you two were a big help with the last big issue we had, anything you guys would be able to take a look at?

LightningManGTS · 2023-10-02T21:33:04Z

Is "appId" and "appSecret" in src/onStarAppConfig.json something we should be making unique in every deployment of this library like device UUID's? Is it possible that all these unique instances are showing up as one "device" and then that's what causing it to get blocked? (due to the total number and frequency of requests?)

I ask not being too familiar with how the reverse engineering works.

My only other question is, what if we ask GM directly? or is there enough trepidation that they would outright deny this by making it harder for the api requests to function? https://www.onstar.com/business-solutions/api-data-services

BrettEBowman · 2023-10-02T23:39:58Z

All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in #232 does not seem to make a difference.

@BigThunderSR: I think that #232 was updated earlier today (Monday, 10/2/23) with another new key pair. Have you been able to test if that gets it working again?

BigThunderSR · 2023-10-02T23:49:49Z

All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in #232 does not seem to make a difference.

@BigThunderSR: I think that #232 was updated earlier today (Monday, 10/2/23) with another new key pair. Have you been able to test if that gets it working again?

I tried it earlier today even though I knew it wouldn't work either and it did not work as expected.

We need @samrum and others to figure out what changed in the API and make the necessary modifications to OnStarJS to make things work again. Thanks.

BrettEBowman · 2023-10-02T23:57:02Z

Bummer! Thanks for trying!

…

-Brett From: BigThunderSR ***@***.***> Sent: Monday, October 2, 2023 6:50 PM To: samrum/OnStarJS ***@***.***> Cc: Brett Bowman ***@***.***>; Manual ***@***.***> Subject: Re: [samrum/OnStarJS] All Requests are Failing with "Request Failed with status 400 - Bad Request" Even with Updated Key (Issue #233) All requests are failing with "Request Failed with status 400 - Bad Request". Updated key in #232<#232> does not seem to make a difference. @BigThunderSR<https://github.com/BigThunderSR>: I think that #232<#232> was updated earlier today (Monday, 10/2/23) with another new key pair. Have you been able to test if that gets it working again? I tried it earlier today even though I knew it wouldn't work either and it did not work as expected. We need @samrum<https://github.com/samrum> and others to figure out what changed in the API and make the necessary modifications to OnStarJS to make things work again. Thanks. — Reply to this email directly, view it on GitHub<#233 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AEEJW7OMH7WYTFNZSCBY57TX5NHKRAVCNFSM6AAAAAA5J3RWYCVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTONBTHEZTCNZSG4>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.******@***.***>>

BennyDaBee · 2023-10-03T01:42:14Z

Between #214 and #208, I am trying to get SSL pinning setup to be able to see the requests in real time. Having issues getting the app just to work on Genymotion

BennyDaBee · 2023-10-03T02:17:13Z

Yea I cant even get the normal app to work on Genymotion before I add anything else to the "device". Any help would be appreciated.

BrettEBowman · 2023-10-03T02:40:57Z

Flespi.com seems to have a [Changelog] general-motors-onstar protocol.

The last entry there (from 4 days ago) says:

general-motors-onstar protocol has been updated, new parameters added:

EHPE - flespi name position.accuracy
AGEIND - flespi name position.valid

That probably does indicate/confirm that there was a recent change to the OnStar API. Those items seems to only relate to getting location, not the authentication call. But maybe it is at least some clue.

nilathedragon · 2023-10-03T08:25:00Z

I think the reason for the 400 / bad_application is that they now require the X-Firebase-AppCheck header on the auth endpoints for the request to go through.

The value for that header comes from that thing:

BennyDaBee · 2023-10-05T16:22:29Z

Im working on getting a Android device to root. I am an iOS person myself so I did not have any on hand. I should have one tonight/tomorrow to be able to test.

Maliron · 2023-10-09T19:36:37Z

I don't think it's all about the Google app-check blocking us. GM does offer partner API access for fleets. I've reached out their business fleet API people and asked if there is any free API access include for personal use with our OnStar membership. We'll if they reply. I seem to recall applying for GM API access before and never hearing back.

nilathedragon · 2023-10-09T19:49:48Z

The thing is this project uses (sort of) public client credentials from their android app, fleet customers will have their own credentials that come with their own rules applied to them. I have tried and I know that passing a valid app-check token in that Firebase header will make the token request work again.

My guess is that GM saw that people were using this reverse engineered API for free and they looked for a quick way to put an end to that by adding app check. I guess thats also why its only on the token endpoint. No token, no service.

Maliron · 2023-10-09T20:01:20Z

That is the pits.. It's such a small subset of users you'd really think it shouldn't be a bit deal to them. I'm sure what they are worried about is someone making money off it. What would be nice is if we could get our own private set of client credentials we could use based off our OnStar subscription. That way it would be unique for each of us, and they wouldn't have to worry, and we'd have our own private API access. I can't see them making a code change like that out of the kindness of their hearts for such a small subset of users though.

Maliron · 2023-10-09T20:27:49Z

Just spitballing here, I was able to sign up for the GM developers site for making in vehicle apps, I wonder if we can get a client ID for access to the API by "designing" an in vehicle app? I've requested commercial API access through there as well now, I won't be holding my breath though.

BigThunderSR · 2023-10-10T19:47:29Z

Thanks much @nilathedragon, #234 has fixed the issue (until OnStar finds another way to block us out again)!!!

BennyDaBee · 2023-10-10T20:16:54Z

@nilathedragon Just for future issues that may arise, how did you go about the SSL Pinning to grab the request credentials for iOS?

nilathedragon · 2023-10-10T20:25:43Z

I do all my iOS work using Frida and Objection. You are able to get around their SSL pinning easily using one of the publicly available Frida scripts.

I chose a different route though, I hooked the systems cryptography API's and caught the credentials there. Once again, there are publicly available Frida scripts for this too :)

jianyu-li · 2023-10-10T20:26:42Z

Thanks @nilathedragon !

Maliron · 2023-10-10T20:35:50Z

Thank you @nilathedragon !! Good job! I can confirm, I recreated my containers and re-pulled with bigthundersr/onstar2mqtt:latest and all is right in the world again. Hopefully one day GM will let us get access to our own personal client id for personal use and we can do this offically,

stamanf · 2023-10-11T23:13:45Z

Also back in business. Thanks everyone, happy again 👍👍

BigThunderSR · 2023-10-12T12:13:09Z

@nilathedragon, could you please see if there is a new key available? The issue is back again this morning, but this time as a 403 - Forbidden. Thanks!

nilathedragon · 2023-10-12T12:15:29Z

As far as I can see, there was no update to the iOS app. Last updated Oct. 2nd

So they must flag something else. I will look into it.

joelvandal · 2024-11-14T22:01:47Z

I pushed some commits to my code that adds some comments and cleans up the logging to make it clearer where each step is happening. I also moved the variables to a .env file. I'm not bothering to store the GM API token outside of memory since it's only good for 30 minutes and a new one can be generated at startup using the persistent tokens from the MS oauth part. MFA should be a one-time thing until something changes on the GM side.

@metheos Thanks, I've start a rewrite based on all your code to work as a webservice,

Ex.

POST /auth

 {
  "email": "[email protected]",
  "password": "userpassword",
}

POST /mfa

 {
  "email": "[email protected]",
  "code": "123456",
}

etc...

Work in progress, but I will send all infos ASAP.

joelvandal · 2024-11-14T23:22:56Z

Hi @metheos,

I wanted to let you know that I’ve made a fork of your repository and created a new branch, webservice, which focuses on adapting the project into a web service. Here's the link:

https://github.com/joelvandal/node-oauth2-gm/tree/webservice

In this implementation:

The authentication process has been split into two distinct steps:

The initial request handles user authentication.
A second request submits the MFA code received by email.

I plan to rewrite certain parts of the process to retain additional information from the authentication response for subsequent usage, rather than directly passing it to the MFA endpoint.

I appreciate the work you've done in the original project and hope this adaptation proves useful. Feel free to reach out if you have any questions or suggestions!

BigThunderSR · 2024-11-14T23:27:16Z

Hi @metheos,

I wanted to let you know that I’ve made a fork of your repository and created a new branch, webservice, which focuses on adapting the project into a web service. Here's the link:

https://github.com/joelvandal/node-oauth2-gm/tree/webservice

In this implementation:

The authentication process has been split into two distinct steps:

The initial request handles user authentication.

A second request submits the MFA code received by email.

I plan to rewrite certain parts of the process to retain additional information from the authentication response for subsequent usage, rather than directly passing it to the MFA endpoint.

I appreciate the work you've done in the original project and hope this adaptation proves useful. Feel free to reach out if you have any questions or suggestions!

@joelvandal, is there any way you can make similar changes in OnStarJS as well? Thanks.

joelvandal · 2024-11-14T23:53:22Z

@BigThunderSR Let me continue to work on the proof of concept (thanks again @metheos) and will eventually check if it possible to implement this logic on OnStarJS.

BigThunderSR · 2024-11-15T03:28:29Z

@joelvandal, are you getting any diagnostics from the code that @metheos provided? I've tried multiple times and it just sits here (after previously completing the MFA step):

data: {
  commandResponse: {
    requestTime: '2024-11-15T03:20:24.598Z',
    url: 'https://na-mobile-api.gm.com/api/v1/account/vehicles/[VIN]/requests/40637592274',
    status: 'inProgress',
    type: 'diagnostics'

metheos · 2024-11-15T03:33:38Z

@BigThunderSR that's all it does, just the initial request to prove that the authentication token is good.

joelvandal · 2024-11-15T13:09:07Z

@joelvandal, are you getting any diagnostics from the code that @metheos provided? I've tried multiple times and it just sits here (after previously completing the MFA step):

I'm working on this part, right now I can now retrieve diagnostics data.

{"success":true,"data":{"commandResponse":{"requestTime":"2024-11-15T13:05:43.514Z","completionTime":"2024-11-15T13:06:01.897Z","url":"https://na-mobile-api.gm.com/api/v1/account/vehicles/XXXXX/requests/XXXXX","status":"success","type":"diagnostics","body":{"diagnosticResponse":[{"name":"CABIN PRECONDITIONING REQUEST","diagnosticElement":[{"name":"CABIN PRECONDITIONING REQUEST","status":"NA","message":"na","value":"NO_ACTION","unit":"N/A"}]},{"name":"CABIN PRECONDITIONING TEMP CUSTOM SETTING","diagnosticElement":[{"name":"SCHEDULED CABIN PRECONDTION CUSTOM SET REQ ACTIVE","status":"NA","message":"na","value":"FALSE","unit":"N/A"},{"name":"SCHEDULED CABIN PRECONDTION CUSTOM SET VALUE","status":"NA","message":"na","value":"23.0","unit":"Cel"}]},{"name":"CHARGER POWER LEVEL","diagnosticElement":[{"name":"CHARGER POWER LEVEL","status":"NA","message":"na","value":"REDUCTION_CHARGE_LEVEL_1","unit":"N/A"}]},{"name":"ENERGY EFFICIENCY","diagnosticElement":[{"name":"CO2 AVOIDED","status":"NA","message":"na"},{"name":"ELECTRIC ECONOMY","status":"NA","message":"na","value":"25.08","unit":"kwh"},{"name":"FUEL AVOIDED","status":"NA","message":"na"},{"name":"GAS MILES","status":"NA","message":"na"},{"name":"LIFETIME EFFICIENCY","status":"NA","message":"na","value":"20.41","unit":"kWH per 100 KM"},{"name":"LIFETIME EV ODO","status":"NA","message":"na"},{"name":"LIFETIME FUEL ECON","status":"NA","message":"na"},{"name":"LIFETIME MPGE","status":"NA","message":"na","value":"35.48","unit":"kmple"},{"name":"ODOMETER","status":"NA","message":"na","value":"6738.2","unit":"KM"}]},{"name":"ESTIMATED CABIN TEMPERATURE","diagnosticElement":[{"name":"ESTIMATED CABIN TEMPERATURE","status":"NA","message":"na","value":"1","unit":"Cel"}]},{"name":"EV BATTERY LEVEL","diagnosticElement":[{"name":"EV BATTERY LEVEL","status":"NA","message":"na","value":"47","unit":"%"}]},{"name":"EV CHARGE STATE","diagnosticElement":[{"name":"EV CHARGE STATE","status":"NA","message":"UNCONNECTED","value":"UNCONNECTED","unit":"N/A"},{"name":"PRIORITY CHARGE INDICATOR","status":"NA","message":"na"},{"name":"PRIORITY CHARGE STATUS","status":"NA","message":"na"}]},{"name":"EV PLUG STATE","diagnosticElement":[{"name":"EV PLUG STATE","status":"NA","message":"unplugged","value":"unplugged","unit":"N/A"}]},{"name":"EV PLUG VOLTAGE","diagnosticElement":[{"name":"EV PLUG VOLTAGE","status":"NA","message":"0","value":"0","unit":"Volts"}]},{"name":"GET CHARGE MODE","diagnosticElement":[{"name":"CABIN PRECOND REQUEST","status":"NA","message":"na","value":"OFF","unit":"N/A"},{"name":"CHARGE DAY OF WEEK","status":"NA","message":"na","value":"Thursday","unit":"N/A"},{"name":"CHARGE HOUR OF DAY","status":"NA","message":"na","value":"0","unit":"Hour"},{"name":"CHARGE MINUTE OF HOUR","status":"NA","message":"na","value":"0","unit":"Min"},{"name":"CHARGE MODE","status":"NA","message":"na"},{"name":"CHARGE MODE RATE TYPE","status":"NA","message":"na","value":"INVALID"},{"name":"CHARGE MODE TYPE","status":"NA","message":"na","value":"CHARGE_NOW"},{"name":"GENERAL AWAY TARGET CHARGE LEVEL","status":"NA","message":"na","value":"100","unit":"%"},{"name":"RATE TYPE","status":"NA","message":"na"}]},{"name":"GET COMMUTE SCHEDULE","diagnosticElement":[{"name":"CHARGE_SCHEDULE_CUST_SETTING","status":"NA","message":"na","value":"OFF"},{"name":"FRI","status":"NA","message":"na","value":"30:62"},{"name":"MON","status":"NA","message":"na","value":"30:62"},{"name":"PRECONDITIONING_SCHEDULE_FRIDAY","status":"NA","message":"na","value":"FALSE"},{"name":"PRECONDITIONING_SCHEDULE_MONDAY","status":"NA","message":"na","value":"FALSE"},{"name":"PRECONDITIONING_SCHEDULE_SATURDAY","status":"NA","message":"na","value":"FALSE"},{"name":"PRECONDITIONING_SCHEDULE_SUNDAY","status":"NA","message":"na","value":"FALSE"},{"name":"PRECONDITIONING_SCHEDULE_THURSDAY","status":"NA","message":"na","value":"FALSE"},{"name":"PRECONDITIONING_SCHEDULE_TUESDAY","status":"NA","message":"na","value":"FALSE"},{"name":"PRECONDITIONING_SCHEDULE_WEDNESDAY","status":"NA","message":"na","value":"FALSE"},{"name":"SAT","status":"NA","message":"na","value":"30:62"},{"name":"SUN","status":"NA","message":"na","value":"30:62"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_FRIDAY","status":"NA","message":"na","value":"80"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_MONDAY","status":"NA","message":"na","value":"80"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_SATURDAY","status":"NA","message":"na","value":"80"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_SUNDAY","status":"NA","message":"na","value":"80"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_THURSDAY","status":"NA","message":"na","value":"80"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_TUESDAY","status":"NA","message":"na","value":"80"},{"name":"TARGET_CHARGE_LEVEL_SCHEDULE_WEDNESDAY","status":"NA","message":"na","value":"80"},{"name":"THU","status":"NA","message":"na","value":"30:62"},{"name":"TUE","status":"NA","message":"na","value":"30:62"},{"name":"WED","status":"NA","message":"na","value":"30:62"}]},{"name":"HIGH VOLTAGE BATTERY PRECONDITIONING STATUS","diagnosticElement":[{"name":"HIGH VOLTAGE BATTERY PRECONDITIONING STATUS","status":"NA","message":"na","value":"INACTIVE","unit":"N/A"}]},{"name":"HOTSPOT CONFIG","diagnosticElement":[{"name":"PASSPHRASE","status":"NA","message":"na","value":"equinox2024a"},{"name":"SSID","status":"NA","message":"na","value":"equinox"}]},{"name":"HOTSPOT STATUS","diagnosticElement":[{"name":"HOTSPOT STATUS","status":"NA","message":"na","value":"ENABLED"}]},{"name":"HV BATTERY CHARGE COMPLETE TIME","diagnosticElement":[{"name":"HV BATTERY CHARGE COMPLETE DAY","status":"NA","message":"na","value":"Friday"},{"name":"HV BATTERY CHARGE COMPLETE HOUR","status":"NA","message":"na","value":"15"},{"name":"HV BATTERY CHARGE COMPLETE MINUTE","status":"NA","message":"na","value":"15"},{"name":"HV BATTERY CHARGE POWER LEVEL","status":"NA","message":"na","value":"240"}]},{"name":"LAST TRIP DISTANCE","diagnosticElement":[{"name":"LAST TRIP EV DISTANCE","status":"NA","message":"na","value":"181.6","unit":"KM"},{"name":"LAST TRIP TOTAL DISTANCE","status":"NA","message":"na","value":"6738.1","unit":"KM"}]},{"name":"LAST TRIP FUEL ECONOMY","diagnosticElement":[{"name":"LAST TRIP ELECTRIC ECON","status":"NA","message":"na","value":"36.32","unit":"kmple"},{"name":"LAST TRIP FUEL ECON","status":"NA","message":"na"}]},{"name":"LIFETIME ENERGY USED","diagnosticElement":[{"name":"LIFETIME ENERGY USED","status":"NA","message":"na","value":"1690.20","unit":"kwh"}]},{"name":"LIFETIME EV ODOMETER","diagnosticElement":[{"name":"LIFETIME EV ODO","status":"NA","message":"na"}]},{"name":"LOCATION BASE CHARGE SETTING","diagnosticElement":[{"name":"LOCATION BASE CHARGE SETTING","status":"NA","message":"na","value":"Off","unit":"N/A"}]},{"name":"ODOMETER","diagnosticElement":[{"name":"ODOMETER","status":"NA","message":"na","value":"6738.2","unit":"KM"}]},{"name":"PREF CHARGING TIMES PLAN","diagnosticElement":[{"name":"WEEKDAY END TIME","status":"NA","message":"na","value":"08:00","unit":"N/A"},{"name":"WEEKDAY START TIME","status":"NA","message":"na","value":"08:00","unit":"N/A"},{"name":"WEEKEND END TIME","status":"NA","message":"na","value":"08:00","unit":"N/A"},{"name":"WEEKEND START TIME","status":"NA","message":"na","value":"08:00","unit":"N/A"}]},{"name":"PREF CHARGING TIMES SETTING"},{"name":"TARGET CHARGE LEVEL SETTINGS","diagnosticElement":[{"name":"ACTIVE TARGET CHARGE SET VAL","status":"NA","message":"na"},{"name":"GENERAL AWAY TARGET CHARGE SET VAL","status":"NA","message":"na"},{"name":"HOME TARGET CHARGE SET VAL","status":"NA","message":"na"},{"name":"LOC BASED CHARGE SET VAL","status":"NA","message":"na"},{"name":"LOC BASED CHARGING HOME LOC STORED","status":"NA","message":"na","value":"FALSE","unit":"N/A"},{"name":"MIN ALLOW GENERAL AWAY TARGET CHARGE SET VAL","status":"NA","message":"na"},{"name":"MIN ALLOW HOME TARGET CHARGE SET VAL","status":"NA","message":"na"},{"name":"PROJECTED EV RANGE GENERAL AWAY TARGET CHARGE SET","status":"NA","message":"na","value":"458.984","unit":"km"},{"name":"PROJECTED EV RANGE HOME TARGET CHARGE SET","status":"NA","message":"na"},{"name":"SHOW CHARGE COMPLETE TXT FC ACTIVE","status":"NA","message":"na"},{"name":"TARGET CHARGE LVL ACTIVE","status":"NA","message":"na"},{"name":"VEH GPS LOCACTION VALID","status":"NA","message":"na"},{"name":"VEH IN HOME LOCATION","status":"NA","message":"na","value":"FALSE","unit":"N/A"},{"name":"VEH LOCATION STATUS INVALID","status":"NA","message":"na","value":"FALSE","unit":"N/A"},{"name":"VEH NOT IN HOME LOC","status":"NA","message":"na","value":"TRUE","unit":"N/A"}]},{"name":"TIRE PRESSURE","diagnosticElement":[{"name":"TIRE PRESSURE LF","status":"NA","message":"YELLOW","value":"244.0","unit":"KPa"},{"name":"TIRE PRESSURE LR","status":"NA","message":"YELLOW","value":"244.0","unit":"KPa"},{"name":"TIRE PRESSURE PLACARD FRONT","status":"NA","message":"na","value":"290.0","unit":"KPa"},{"name":"TIRE PRESSURE PLACARD REAR","status":"NA","message":"na","value":"290.0","unit":"KPa"},{"name":"TIRE PRESSURE RF","status":"NA","message":"YELLOW","value":"244.0","unit":"KPa"},{"name":"TIRE PRESSURE RR","status":"NA","message":"YELLOW","value":"244.0","unit":"KPa"}]},{"name":"VEHICLE RANGE","diagnosticElement":[{"name":"EV MAX RANGE","status":"NA","message":"na"},{"name":"EV MIN RANGE","status":"NA","message":"na"},{"name":"EV RANGE","status":"NA","message":"na","value":"200.98","unit":"KM"},{"name":"GAS RANGE","status":"NA","message":"na"},{"name":"TOTAL RANGE","status":"NA","message":"na"}]}]}}}}

joelvandal · 2024-11-15T13:49:56Z

All work :) I can start/stop the velicle, lock/unlock (door and trunk), location, etc.

I need to do more cleanup and check how this can be integrated on OnStarJS.

For now this version (based on original code from metheos), it a standalone / replacement solution for OnStarJS.

https://github.com/joelvandal/node-oauth2-gm/tree/webservice

joelvandal · 2024-11-15T16:57:11Z

I have a 100% working version available on :

https://github.com/joelvandal/node-oauth2-gm

Most, if not all commands are implemented.

metheos · 2024-11-15T18:17:13Z

Nice work @joelvandal !
Just FYI I pinned openid-client at the last v5 release because v6 had breaking changes I was too lazy to figure out.

joelvandal · 2024-11-15T18:38:07Z

Nice work @joelvandal ! Just FYI I pinned openid-client at the last v5 release because v6 had breaking changes I was too lazy to figure out.

Now I need to figure how to retrieve list of vehicles since we need to pass VIN on getGMAPIToken function.

Normally it a request to https://na-mobile-api.gm.com/api/v1/account/vehicles ...

joelvandal · 2024-11-15T18:46:48Z

I found how... sorry :) Must clean some functions :) Now I think I have all infos I need :)

metheos · 2024-11-15T20:55:37Z

Now I need to figure how to retrieve list of vehicles since we need to pass VIN on getGMAPIToken function.

You should only need the VIN when sending commands, it's not needed to get the GM API Token.
I see you found the API endpoint that returns the available vehicles, but you can also get the available VIN information from the GM API Token payload without querying the API at all.

{
  ...
  "scope": "gmoc priv user_trailer user role_owner onstar",
  ...
  "vehs": [
    {
      "vin": "<MY MAIN VEHICLE VIN>",
      "per": ...
    },
    {
      "vin": "<SHARED VEHICLE VIN>",
      "per": ...
    }
  ]
}

LightningManGTS · 2024-11-16T04:25:19Z

@joelvandal @metheos

I had posed a question to @BigThunderSR in his own repo for the node-red project to prevent off topic clutter however it rounds back anyways. BigThunderSR/node-red-contrib-onstar2#271

What's the feasibility of modifying both code bases here to either pipe the new auth method into OnStarJS or to reconjigure the new code base to make the functions, file names, and endpoints similar enough that existing projects leveraging OnStarJS don't need to go through complete rewrites?

Apologies if this is already being consider and/or actively being worked on.

Z1mDMan · 2024-11-17T02:47:44Z

pardon my ignorance, this sounds great above, is this something that can/will flow down to things like homebridge-onstar? I appreciate all of you devs and your work with this!

meilechwieder · 2024-11-17T22:36:23Z

Thank you so much guys for your effort in making this work!

Would it be possible for someone to send me a code snippet on how to use this? Because When I try to run it with [email protected], I'm getting a 400 bad reqeust when fetching "https://na-mobile-api.gm.com/sec/authz/v3/oauth/token"

metheos · 2024-11-18T17:39:34Z

I just realized we can make the authentication fully hands-off if we use the 3rd party authenticator option for MFA!
It's a standard TOTP SHA1 algorithm. You'd just need to supply the TOTP key from your authenticator app so the codes can be generated during the authentication process.

I'll test this out later today, but I can't see why it wouldn't work. This feels like the way forward for automated implementations like homeassistant, etc.

joelvandal · 2024-11-18T20:36:51Z

I just realized we can make the authentication fully hands-off if we use the 3rd party authenticator option for MFA! It's a standard TOTP SHA1 algorithm. You'd just need to supply the TOTP key from your authenticator app so the codes can be generated during the authentication process.

I'll test this out later today, but I can't see why it wouldn't work. This feels like the way forward for automated implementations like homeassistant, etc.

Let me know :) I'm doing some test also on MFA, ex. using Phone (SMS) and TOTP.

About TOTP, the mfaRequestURL look like :

https://custlogin.gm.com/gmb2cprod.onmicrosoft.com/B2C_1A_MFA_AUTH_TOTP_ENROLL/api/SelfAsserted/confirmed?csrf_token=${csrfToken}&tx={$transId}&p=B2C_1A_MFA_AUTH_TOTP_ENROLL

We can detect the MFA method from the response payload.

 const responseText = JSON.stringify(mfaResponse.data);
    console.log(responseText);

    const confirmData = {}
    let verificationType = '';
    if (responseText.includes('phoneVerificationControl')) {
      verificationType = 'phone';
      confirmData.verificationCode = '+1NPANXXNXXX';
    } else if (responseText.includes('emailVerificationControl')) {
      verificationType = 'email';
      confirmData.emailMfa = email;
    } else if (responseText.includes('otpCode')) {
      verificationType = 'otp';
      res
        .status(302)
        .send({ success: true, error: "OTP Authentification method." });
        return;
    } else {
      res
        .status(302)
        .send({ success: false, error: "Unsupported authentification method." });
        return;
    }

metheos · 2024-11-18T20:41:33Z

Updated my test code to use TOTP.
This enables fully automated authentication. This should simplify replacing existing functions in OnStarJS.
You will need to change your account's MFA method to "Third-Party Authenticator App" and use an authenticator app that allows you to view your TOTP secrets so you can provide it in .env.
https://www.chevrolet.com/myaccount/security

Loading existing MS tokens, if they exist.
Doing auth discovery
No existing tokens found or were invalid. Doing full auth sequence.
Starting PKCE auth
Doing auth discovery
got PKCE code verifier: <REDACTED>
Response Status: 200
Sending GM login credentials
Response Status: 200
Loading MFA Page
> Response Status: 200
Submitting OTP Code: <REDACTED>
Response Status: 200
Requesting PKCE code
Doing auth discovery
Access Token: <REDACTED>
ID Token: <REDACTED>
Saving MS tokens to  ./tokens.json
Loading existing MS tokens, if they exist.
Doing auth discovery
MS Access token is still valid
Saving current MS tokens to  ./tokens.json
Requesting GM API Token using MS Access Token
Response Status: 200
Set GM Token expiration to  1731964159
{
  access_token: 'REDACTED',
  token_type: 'bearer',
  issued_token_type: 'urn:ietf:params:oauth:token-type:access_token',
  expires_in: '1798',
  scope: 'gmoc priv user_trailer user role_owner onstar',
  onstar_account_info: { account_no: 'REDACTED', country_code: 'US' },
  errors: null,
  expires_at: 1731964159
}
Testing GM API Request
...
  data: {
    commandResponse: {
      requestTime: '2024-11-18T20:39:21.662Z',
      url: 'https://na-mobile-api.gm.com/api/v1/account/vehicles/<REDACTED>/requests/40810864298',
      status: 'inProgress',
      type: 'diagnostics'
    }
  }

evilpig · 2024-11-18T20:44:53Z

@metheos

One thing of note, my Canadian GM account doesn't seem to support an Authenticator App unfortunately.

joelvandal · 2024-11-18T20:46:09Z

@evilpig Try to log with https://my.gm.ca ... I see 3rd party authentication

evilpig · 2024-11-18T21:00:02Z

@metheos

One thing of note, my Canadian GM account doesn't seem to support an Authenticator App unfortunately.

@evilpig Try to log with https://my.gm.ca ... I see 3rd party authentication

Ah, I see it in Desktop mode and on my PC. Something seems to be very wrong with the GM Portal. I was able to disable email 2FA. But when I click on Authenticator to start the process, it directs me to https://accounts.gm.com/delete/review?error=redirect_uri_mismatch&error_description=AADB2C90006%3a+The+redirect+URI+%27https%3a%2f%2fwww.gmccanada.ca%2fen%2fmyaccount%2fsecurity%27+provided+in+the+request+is+not+registered+for+the+client+id+.... redacted part of the url. Then it redirects me to www.cadillac.com. Very strange. Just figured I'd share! Thanks for all the work everyone is doing to get this going again.

jianyu-li · 2024-11-18T21:04:27Z

Just confirming that it was not available for me on mobile but WAS available on desktop (once email 2FA was disabled)

joelvandal · 2024-11-18T21:08:21Z

Maybe not the best time to test :) GM look to do crap things on server... I'm now redirected to cadillac.com ... my.gm.com redirect to http://..com etc...

LOL

mdezzi · 2024-11-19T14:20:33Z

@joelvandal Hi, firstly, thank you for all your hard work.
I've cloned your repo and i am trying to test this in my environment. I am running the server locally and using postman to make the POST calls to the node endpoints.

When I make the POST to /auth with my email and password, I get a 200 response and a success message, but when looking at the Node terminal, it looks like axios received a 500 error from the GM endpoint, is that normal?

As i work through the chain of POST calls, I also see another axios 500 error when submitting my MFA code, and finally when i POST to /vehicles, i get a 404 response and the message says "Tokens not found", so even though i am receiving success messages back from the node endpoints, it doesnt look like the communication with the GM api is successful. Any tips?

EDIT: i am testing this to see if it is possible to integrate 2fauth and reterive the MFA code automatically behind the scenes and supply it to the API.

joelvandal · 2024-11-19T14:30:11Z

@mdezzi If you got a 500 errof, it probably because your MFA is not set to Email ?

I'm currently checking to implement SMS and OTP method.

joelvandal · 2024-11-19T14:32:34Z

@mdezzi P.S. all work was been possible only with the help from @metheos

mdezzi · 2024-11-19T15:55:57Z

@joelvandal Ahh, sorry I skimmed through this thread and thought the OTP method was implemented already. I switched back to email and it looks to be working correctly. I'll keep monitoring to see if you're able to implement OTP, my ideal flow would be to stand this up on its own in a docker container alongside 2fauth. Then, theoretically, i could use Node-Red/Home Assistant to grab the OTP from 2fauth api, and submit during the authentication automatically. Really excited about this, thanks again and thanks @metheos for your hard work too.

joelvandal · 2024-11-19T15:58:00Z

@mdezzi OTP is implemented on @metheos version but require to have an application that allow to view the secret key (Google Authentication dont' allow), but I still working on this in my version.

This was referenced Sep 27, 2023

"Error: Request Failed with status 400 - Bad Request" BigThunderSR/node-red-contrib-onstar2#60

Closed

getLocation error BigThunderSR/homeassistant-addons-onstar2mqtt#235

Closed

This was referenced Oct 2, 2023

400 - Bad Request michaelwoods/onstar2mqtt#309

Closed

Error 400 Main function Error BigThunderSR/homeassistant-addons-onstar2mqtt#236

Closed

nilathedragon mentioned this issue Oct 10, 2023

Bypass Firebase App-Check #234

Merged

LightningManGTS mentioned this issue Nov 15, 2024

Error: Request Failed with status 400 - Bad Request BigThunderSR/node-red-contrib-onstar2#271

Open

All Requests are Failing with "Request Failed with status 400 - Bad Request" Even with Updated Key #233

All Requests are Failing with "Request Failed with status 400 - Bad Request" Even with Updated Key #233

Comments

BigThunderSR commented Sep 27, 2023

Maliron commented Sep 27, 2023

LightningManGTS commented Sep 28, 2023 • edited Loading

tbclark3 commented Sep 28, 2023

BennyDaBee commented Sep 30, 2023

LightningManGTS commented Oct 2, 2023

BrettEBowman commented Oct 2, 2023

BigThunderSR commented Oct 2, 2023

BrettEBowman commented Oct 2, 2023 via email

BennyDaBee commented Oct 3, 2023

BennyDaBee commented Oct 3, 2023

BrettEBowman commented Oct 3, 2023

nilathedragon commented Oct 3, 2023

BennyDaBee commented Oct 5, 2023

Maliron commented Oct 9, 2023

nilathedragon commented Oct 9, 2023

Maliron commented Oct 9, 2023

Maliron commented Oct 9, 2023

BigThunderSR commented Oct 10, 2023

BennyDaBee commented Oct 10, 2023

nilathedragon commented Oct 10, 2023

jianyu-li commented Oct 10, 2023

Maliron commented Oct 10, 2023

stamanf commented Oct 11, 2023

BigThunderSR commented Oct 12, 2023 • edited Loading

nilathedragon commented Oct 12, 2023

joelvandal commented Nov 14, 2024

joelvandal commented Nov 14, 2024

BigThunderSR commented Nov 14, 2024

joelvandal commented Nov 14, 2024

BigThunderSR commented Nov 15, 2024 • edited Loading

metheos commented Nov 15, 2024

joelvandal commented Nov 15, 2024

joelvandal commented Nov 15, 2024

joelvandal commented Nov 15, 2024

metheos commented Nov 15, 2024

joelvandal commented Nov 15, 2024

joelvandal commented Nov 15, 2024

metheos commented Nov 15, 2024 • edited Loading

LightningManGTS commented Nov 16, 2024

Z1mDMan commented Nov 17, 2024

meilechwieder commented Nov 17, 2024

metheos commented Nov 18, 2024

joelvandal commented Nov 18, 2024

metheos commented Nov 18, 2024

evilpig commented Nov 18, 2024

joelvandal commented Nov 18, 2024

evilpig commented Nov 18, 2024

jianyu-li commented Nov 18, 2024

joelvandal commented Nov 18, 2024

mdezzi commented Nov 19, 2024 • edited Loading

joelvandal commented Nov 19, 2024

joelvandal commented Nov 19, 2024

mdezzi commented Nov 19, 2024

joelvandal commented Nov 19, 2024

LightningManGTS commented Sep 28, 2023 •

edited

Loading

BigThunderSR commented Oct 12, 2023 •

edited

Loading

BigThunderSR commented Nov 15, 2024 •

edited

Loading

metheos commented Nov 15, 2024 •

edited

Loading

mdezzi commented Nov 19, 2024 •

edited

Loading