title: Reverse engineering the Xbox One Smartglass app's API authorization header
body: <p>Since Microsoft decided to put the profile pages for Xbox Live users behind a login wall for some stupid reason I have been forced to find other means to determine if a Xbox Live user is online or not.</p>
  
  <p>To do this I have used mitmproxy to figure out the requests being made by the Xbox One Smartglass app for iOS. It appears that for any request that requires authentication the app populates the "Authentication" header field with "XBL3.0 x={computed auth token}".</p>
  
  <p>I have figured out that the app gets an access token by doing a POST request to <a href="https://login.live.com/oauth20_token.srf" rel="noreferrer">https://login.live.com/oauth20_token.srf</a> and passes in form encoded data of which one of the properties is the user's "refresh_token". You can get this refresh token by simply looking at any of these requests with mitmproxy.</p>
  
  <p>The app then proceeds to do a POST request to <a href="https://user.auth.xboxlive.com/user/authenticate" rel="noreferrer">https://user.auth.xboxlive.com/user/authenticate</a> passing in a variety of information whose origin I cannot determine. Below is an example JSON payload of this request:</p>
  
  <pre><code>{
      "Properties": {
          "AuthMethod": "RPS", 
          "RpsHeader": "&lt;data removed for safety&gt;", 
          "RpsTicket": "&lt;data removed for safety&gt;", 
          "SiteName": "user.auth.xboxlive.com"
      }, 
      "RelyingParty": "http://auth.xboxlive.com", 
      "TokenType": "JWT"
  }
  </code></pre>
  
  <p>The response of this request contains the following JSON:</p>
  
  <pre><code>{
      "DisplayClaims": {
          "xui": [
              {
                  "uhs": "&lt;data removed for safety&gt;"
              }
          ]
      }, 
      "IssueInstant": "2014-08-02T23:44:56.5868148Z", 
      "NotAfter": "2014-08-16T23:44:56.5868148Z", 
      "Token": "&lt;data removed for safety&gt;"
  }
  </code></pre>
  
  <p>The contents of "uhs" and "token" concatenated together appear to be the missing auth token from the "XBL3.0 x=" authorization header.</p>
  
  <p>The problem is I have absolutely no familiarity with Microsoft's web stack and after hours of searching I cannot figure out where the values for "RpsHeader" and "RpsTicket" come from.</p>