Authentication Issue

[monkeyworknet]

ERRO[0000] Could not log in: Received status code 401

Looks like Hover has forced 2 factor, any work arounds for the app?

[gitbls]

I'm interested in this as well. Thx!

[dschanoeh]

I can confirm that I'm having the same issue and don't see a workaround right now.

[gitbls]

I spoke with Hover Support about this yesterday. The API broke because they enabled MFA for all accounts with no notification. They said that they are not hearing from enough people needing API interfaces to Hover for them to invest in making it work in this new security regime. I mentioned that both Microsoft and Google have app passwords which they could implement as well, but no positive response on this from them yet.

If this is important to you, PLEASE contact Hover support and let them know that you use the API, and that them disabling access to it is a serious problem for you.

[monkeyworknet]

as an alternative option I've been experimenting with Cloudflare tunnels - if this can't be resolved may be something those who are doing homelab type work might want to investigate

[brandonscript]

I just emailed support about this, too.

In the mean time, I discovered that you can edit and re-send API calls to hover to create records that bypass their input form restrictions. If you create a new CNAME record called * pointing to say, .duckdns.org, you can then "Edit and resend" the response (using browser dev tools) and change the * to an @ and resend the response. This will effectively create a CNAME record for your root domain, too. (Which apparently isn't supposed to work according to IANA, and yet?) Just keep in mind:

What’s important here is that this is a contractual limitation, not a technical one. It is possible to use a CNAME at the root, but it can result in unexpected errors, as it is breaking the expected contract of behavior.

Edit: * also will work as a wildcard CNAME redirect, in case you can get away with just using subdomains.

[back-87]

I called them to ask what's up, made it clear I depend on the API. They apologized. She linked me this github as I'd forgotten how I even wrote my script years ago. They might be starting to get the motivation to work on this, I hope.

[tj90241]

Does not look like they intend to support this anytime soon. I e-mailed them and the response I got was:

---

Thank you for reaching out to Hover Support and for your sharing this candid feedback with us.

While we do not support API at this time, a possible workaround is to use a 3rd party DNS provider such as Cloudflare. We certainly value you as a Hover customer and would love to see our platform continue to meet your needs where possible. Please don't hesitate to reach out if we can help with anything else.

[tj90241]

I should not say this in case someone from Hover is watching and is actively trying to sabotage use of the API, but it turns out this is still very workable.

In order for the browser to authenticate against the API, 3 cookies are needed (__zlcmid, hover_session, and hoverauth). The latter two have an expiry of "Session" (meaning the API itself does not seem to associate an expiry with them). The former has an expiry of almost a year.

So... if you just manually craft cookies in place of the username/password authentication formerly used, you should only have to login to the browser and go through the 2FA cycle once per year. This is very doable, at least for me!

I've adjusted my scripts to account for this and it works without any other changes. Time will tell if the usability of the session persists for up to a year or not.

[tj90241]

Just checking in -- still working a couple days later with the same cookies! Looks like this is the workaround.

[tj90241]

And... still working weeks later now! (I'll stop bumping after this)

[gitbls]

It appears that Hover are not proactively checking/reinforcing this, so if you can figure out a way to make it work, it will stay working. For now, anyhow. 🤷‍♀️

I've concluded that if mine ever stops working I'll be putting my ddns on noip (but keep Hover as the registrar). They are much more proactive than Hover about enabling api access even with 2FA enabled.

[simonevetere]

I should not say this in case someone from Hover is watching and is actively trying to sabotage use of the API, but it turns out this is still very workable.

In order for the browser to authenticate against the API, 3 cookies are needed (__zlcmid, hover_session, and hoverauth). The latter two have an expiry of "Session" (meaning the API itself does not seem to associate an expiry with them). The former has an expiry of almost a year.

So... if you just manually craft cookies in place of the username/password authentication formerly used, you should only have to login to the browser and go through the 2FA cycle once per year. This is very doable, at least for me!

I've adjusted my scripts to account for this and it works without any other changes. Time will tell if the usability of the session persists for up to a year or not.

can you please help me for do this workaround with python script ?

[shlevy]

@tj90241 Is your workaround still working? Any chance you can share the scripts?

[malhal]

Hover Support's recommendation to use Cloudflare's free plan as nameserver still with Hover as the registrar was very easy. Cloudflare auto-imported all the DNS records from Hover, whilst Hover keeps the originals available for reference with a note at the top: "This domain is using third-party nameservers. DNS records added here won't have an effect." I'll probably just transfer my domain to Cloudflare anyway since it's half the price but thought I'd try this first.

[l0ckm4]

I have managed to write my own script that goes through 2FA on hover. Essentially, I curl to the login page first (https://www.hover.com/signin) and store the cookies in a cookie file - this holds the session details. I then reuse that cookie file and POST my username and password to https://www.hover.com/signin/auth.json. This should return with a JSON answer stating 2FA code is required. I then monitor my inbox for the 2FA code and retrieve it and post it to https://www.hover.com/signin/auth2.json again using same cookie file. Once done I can then modify my A records by submitting a PUT request to https://www.hover.com/control_panel/domain/yourdomain.com/dns. Dev tools in chrome was pretty useful in helping me figure this out.

My code automates everything and allows me to failover DNS records to our secondary site within seconds.