Cookies?

[scruffynerf]

Is there a reason this doesn't support Cookies to allow using a user, to get things like adult movie metadata, etc?

I just stumbled on the project as I'm working along some similar lines. I was inspired by your project to switch to curcl-cffi. I have a working curl-cffi login script I could submit a pull request. And if you could provide some guidance on which files would be effected, I could work on this.

This is already solved on my end using curl-cffi, and it doesn’t rely on HTML scraping at all.
I’m using a small cookie + CSRF session wrapper that talks directly to the same internal JSON endpoints the Letterboxd web app uses.

No DOM parsing.
No browser automation.

It’s been running reliably in a real pipeline with multiple state-changing test cases.

What already works (no scraping)

All of these are pure AJAX mutations captured from real browser traffic:

1. Toggle “watched”

POST https://letterboxd.com/ajax/watch.json

Payload:

{
  "watchableId": film_id,
  "watchableType": "film",
}

2. Toggle watchlist

POST https://letterboxd.com/ajax/letterboxd-metadata/
productions=film:<id>

• This endpoint toggles watchlist state based on the current server value.
  It does not accept an explicit add/remove flag.

• The response reflects the new state (e.g. watchlisted: ["film:14479"] indicates added; if watchlisted is absent, it was removed).

3. List creation + list mutation
   I’ve also implemented list creation and item updates using the same trace-locked approach.
   They behave exactly like the web UI and only require cookies + CSRF — still no scraping.

Caveat (lists):
The current letterboxdpy List model does not retain the permanent Letterboxd list ID.
Mutating a list via the AJAX endpoints later requires this ID, so list updates currently need to re-resolve it before performing any write operations.

How auth is handled

A UserSession wrapper that:

• loads/saves cookies from disk
• resolves CSRF from the cookie jar (with a fallback scan)
• validates the session with a normal authenticated GET
• only prompts for login if cookies are stale

Once initialized, it behaves exactly like a logged-in browser session and can safely call the internal JSON endpoints.

This doesn’t require rewriting or breaking any existing code.
It can live alongside the current HTML-scraping API and be used only when a user opts into authentication.

I’ve opened a PR that implements the optional authenticated session we discussed, using only trace-locked endpoints and no HTML scraping.

It’s strictly additive.

PR: #158

—
Better to ask forgiveness than permission.

A happy little screenshots showing a happy little list

[fastfingertips]

Supported in v6.4.0 with the new UserSession module. Check the README for authentication details.