Pixiv is one of the world largest image sharing central which focuses on sharing, posting, and promoting illustrations and artwork, whether it's 2D, 3D, Animation, and possibly more. If you know DeviantArt, then Pixiv is just like that but mainly used by Japanese Artists, thus makes the web interface is mostly in japanese.

However, being a software developer that also coincidentally love seeing pretty illustrations of neko musume and other sweet stuffs, I have a habit to share my findings to others, and i do it a lot. When I said "a lot", i mean it. And it's kind of a hassle to switch back and forth between Pixiv page and Discord server on several channels (or even servers) just to share several good stuffs.

This process can be automated.

And so I did. I created a Discord bot in order to share stuff easily. It works by registering a channel with a tag, and give POST request with Pixiv post information plus specified tag, and the bot will post the Pixiv post on the channels that has the specified tag.

I also developed a Chrome Extension (dubbed "Warfarin) that allows to communicate with the bot. It's mostly just HTTP request to REST API in the server

But the thing with Discord messages that came from Pixiv is that it's mostly cropped. This is because the embed image provided by Pixiv crops only to certain parts on the top.

And so, what I had in mind was to download the image first, then upload to Discord.

Then another problem arose. You can't just make pure GET request for the image if it's not within Pixiv itself. It will give you 403 Forbidden error.

Tinkering Request Headers

Since this is a GET request, there should be no payloads being sent. It all back to the request headers to determine the permission and such. And after comparing both the request headers between in-site request and ex-site request, I found that there is absence of "referer" header on the ex-site request. The value of the said header is analogous to where does this piece got referenced in the site, that is to say, your current location in the address bar.

And so, after adding the referer header, it just works. Status 200 OK

It's just a very simple trick but actually tells that it's not just about the body or payload you sent, it's also about the header of your request. In several sites, your access token is saved as a cookie and is included in every request to protected route or protected resource in the site.

And so, by adding the required header, then saving the image into file, I can finally be able to upload the image to Discord server.

Afterword

I think it's a simple small stuff that people could just forget. Simple small stuff that could be abused as a vulnerability.

But yeah, happy that my bot finally posted the full image to them channels without any croppings ^_^

How tampering the request headers can give you access to Pixiv resources externally