当前位置：首页 > news >正文

Cursor长效Token获取核心技术解析

news 2025/10/11 3:54:10

Cursor长效Token获取核心技术解析

深入剖析从Cursor登录Cookie到长效Token的完整技术流程

cursor 账号管理工具

https://pan.quark.cn/s/37259245983b#/list/share

前言

Cursor作为AI驱动的代码编辑器，其认证机制涉及两种token：短效的Cookie token用于Web端认证，长效的Session token用于客户端认证。本文将从技术角度详细解析这一转换过程。

一、Token类型说明

1.1 短效Cookie Token（Web端认证）

从Cursor Web端登录后获得的Cookie格式为：

WorkosCursorSessionToken = user_id%3A%3Ajwt_token

实际示例：

user_01K43D4JHZ7HVR1VQ3GWHQ7PG1%3A%3AeyJhbGciOiJNaIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhdXRoMHx1c2VyXzAxSzQzRDRKSFo3SFZSMVZRM0dXSFE3UEcxIiwidGltZSI6IjE3NTY3NTYwODYiLCJyYW5kb21uZXNzIjoiZjBkMWNhMzEtOTM2NS00Njc3IiwiZXhwIjoxNzYxOTQwMDg2LCJpc3MiOiJodHRwczovL2F1dGhlbnRpY2F0aW9uLmN1cnNvci5zaCIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwgb2ZmbGluZV9hY2Nlc3MiLCJhdWQiOiJodHRwczovL2N1cnNvci5jb20iLCJ0eXBlIjoic2Vzc2lvbiJ9.va_W-h_MP8hMnTMYsxlVDZZk0FQNfwKM-S3K5C9d8p8

特点说明：

用途: Cursor Web端后台的认证信息
Token类型: type: "web"
格式: user_id%3A%3Ajwt_token（%3A%3A 是 :: 的URL编码）

1.2 长效Session Token（客户端认证）

通过PKCE流程获得的长效Token用于Cursor客户端认证：

特点说明：

用途: Cursor客户端的认证信息
Token类型: type: "session"
获取方式: 通过PKCE OAuth 2.0流程转换

1.3 JWT Token结构解析

JWT Token包含三部分：header.payload.signature

Payload解码后的内容：

{"sub": "auth0|user_01K43D4JHZ7HVR1VQ3GWHQ7PG1","time": "1756756086","randomness": "f0d1ca31-9365-4677","exp": 1761940086,"iss": "https://authentication.cursor.sh","scope": "openid profile email offline_access","aud": "https://cursor.com","type": "session"
}

关键字段：

sub: 用户标识
exp: 过期时间戳
type: Token类型（"web" 或 "session"）
scope: 权限范围

二、PKCE OAuth 2.0核心流程

2.1 PKCE挑战码生成

import secrets
import hashlib
import base64def generate_pkce_challenge():# 生成32字节随机字符串作为code_verifiercode_verifier = secrets.token_urlsafe(32)# 对code_verifier进行SHA256哈希sha256_hash = hashlib.sha256(code_verifier.encode('utf-8')).digest()# Base64 URL安全编码code_challenge = base64.urlsafe_b64encode(sha256_hash).rstrip(b'=').decode('utf-8')return code_verifier, code_challenge

示例输出：

code_verifier: "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

2.2 登录URL构造

import uuiddef create_login_url():request_uuid = str(uuid.uuid4())code_verifier, code_challenge = generate_pkce_challenge()login_url = f"https://cursor.com/cn/loginDeepControl?challenge={code_challenge}&uuid={request_uuid}&mode=login"return login_url, request_uuid, code_verifier

完整URL示例：

https://cursor.com/cn/loginDeepControl?challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&uuid=f47ac10b-58cc-4372-a567-0e02b2c3d479&mode=login

2.3 Cookie预设置

在访问登录URL前，需要设置现有的短效token作为Cookie：

def set_auth_cookie(page, user_id, access_token):cookie = {'name': 'WorkosCursorSessionToken','value': f"{user_id}%3A%3A{access_token}",'domain': '.cursor.com','path': '/','secure': True,'httpOnly': True,'sameSite': 'Lax'}page.set.cookies(cookie)

三、长效Token轮询获取

3.1 轮询端点

API端点： https://api2.cursor.sh/auth/poll

请求方式： GET

关键参数：

uuid: 登录请求的唯一标识
verifier: PKCE的code_verifier

3.2 请求头构造

import secretsdef build_headers():# 动态生成分布式追踪IDtrace_id = secrets.token_hex(16)parent_id = secrets.token_hex(8)traceparent = f"00-{trace_id}-{parent_id}-00"return {"Host": "api2.cursor.sh","Origin": "vscode-file://vscode-app","User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Cursor/1.2.2 Chrome/132.0.6834.210 Electron/34.5.1 Safari/537.36","accept": "*/*","sec-ch-ua": '"Not A(Brand";v="8", "Chromium";v="132"',"sec-ch-ua-mobile": "?0","sec-ch-ua-platform": '"macOS"',"sec-fetch-site": "cross-site","sec-fetch-mode": "cors","sec-fetch-dest": "empty","accept-language": "zh-CN","traceparent": traceparent,"x-ghost-mode": "true","x-new-onboarding-completed": "false"}

3.3 轮询核心逻辑

import requests
import timedef poll_for_token(request_uuid, code_verifier, max_attempts=50, interval=2):polling_url = "https://api2.cursor.sh/auth/poll"for attempt in range(max_attempts):headers = build_headers()params = {"uuid": request_uuid,"verifier": code_verifier}try:response = requests.get(polling_url, headers=headers, params=params, timeout=10)if response.status_code == 200:data = response.json()if "accessToken" in data and "refreshToken" in data:return {"access_token": data["accessToken"],"refresh_token": data["refreshToken"],"user_id": data.get("userId", "")}elif response.status_code == 404:# 404是正常状态，表示用户尚未确认登录passelse:print(f"Unexpected status code: {response.status_code}")except requests.exceptions.RequestException as e:print(f"Request error: {e}")time.sleep(interval)return None

状态码含义：

200: 成功获取token
404: 等待用户确认登录（正常状态）
其他: 异常状态

3.4 成功响应格式

{"accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...","refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...","userId": "user_01K43D4JHZ7HVR1VQ3GWHQ7PG1"
}