title: Login with python requests and csrf-token
body: <p>I am using the requests module for python to try to login on a webpage. I open up a requests.session(), then I get the cookie and the csrf-token which is included in a meta tag. I build up my payload with username, password, a hidden input field and the csrf-token from the meta tag. After that i use the post method and I am passing through the login url, the cookie, the payload and the header. But after that I can't access a page behind the login page.
  What am I doing wrong?</p>
  
  <p>This is the request header when I perfom a login:</p>
  
  <pre><code>Request Headers:
  
  :authority: www.die-staemme.de
  :method: POST
  :path: /page/auth
  :scheme: https
  accept: application/json, text/javascript, */*; q=0.01
  accept-encoding: gzip, deflate, br
  accept-language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
  content-length: 50
  content-type: application/x-www-form-urlencoded
  cookie: cid=261197879; remember_optout=0; ref=start; 
  PHPSESSID=3eb4f503f38bfda1c6f48b8f9036574a
  origin: https://www.die-staemme.de
  referer: https://www.die-staemme.de/
  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
  x-csrf-token: 3c49b84153f91578285e0dc4f22491126c3dfecdabfbf144
  x-requested-with: XMLHttpRequest
  </code></pre>
  
  <p>This is my code so far:</p>
  
  <pre><code>import requests
  from bs4 import BeautifulSoup as bs
  import lxml
  
  # Page header
  head= { 'Content-Type':'application/x-www-form-urlencoded',
  'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36'
  }
  # Start Page
  url = 'https://www.die-staemme.de/'
  # Login URL
  login_url = 'https://www.die-staemme.de/page/auth'
  # URL behind the login page
  url2= 'https://de159.die-staemme.de/game.php?screen=overview&amp;intro'
  
  # Open up a session
  s = requests.session()
  
  # Open the login page
  r = s.get(url)
  
  # Get the csrf-token from meta tag
  soup = bs(r.text,'lxml')
  csrf_token = soup.select_one('meta[name="csrf-token"]')['content']
  
  # Get the page cookie
  cookie = r.cookies
  
  # Set CSRF-Token
  head['X-CSRF-Token'] = csrf_token
  head['X-Requested-With'] = 'XMLHttpRequest'
  
  # Build the login payload
  payload = {
  'username': '', #&lt;-- your username
  'password': '', #&lt;-- your password
  'remember':'1' 
  }
  
  # Try to login to the page
  r = s.post(login_url, cookies=cookie, data=payload, headers=head)
  
  # Try to get a page behind the login page
  r = s.get(url2)
  
  # Check if login was successful, if so there have to be an element with the id menu_row2
  soup = bs(r.text, 'lxml')
  element = soup.select('#menu_row2')
  print(element)
  </code></pre>