kenzuya/unshackle
1
0
Fork 2
mirror of https://github.com/unshackle-dl/unshackle.git synced 2026-11-14 13:05:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(proxies)!: rewrite ExpressVPN provider to Android device login

Browse Source 
Swap cookie/PKCE auth for the OAuth 2.0 device authorization grant with a cached rotating refresh token. Fix the connection-token key (`cat`) and move the cache to {cache}/vpn/ to match ProtonVPN.

BREAKING CHANGE: cookie-file auth removed; run once with `enable: true` to approve a device code.
This commit is contained in:
imSp4rky
2026-07-09 11:20:38 -06:00
parent 4ebe41fafd
commit 847696b301
6 changed files with 306 additions and 629 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guide/proxies-and-vpn.md
+25 -17
View File
@@ -107,8 +107,8 @@ provider, prefix the query (`--proxy nordvpn:us`).
!!! note "Auto-loading providers"
Most providers only load when you configure them under `proxy_providers:`. Three are
special: **ExpressVPN** and **Proton VPN** also load automatically if their cookie
file already exists on disk (even with no YAML), and **Hola** loads automatically
special: **ExpressVPN** and **Proton VPN** also load automatically once their cached
session file exists on disk (even with no YAML), and **Hola** loads automatically
whenever the `hola-proxy` binary is found on your `PATH`.
### Connection feedback
@@ -347,24 +347,24 @@ Understanding what Gluetun does behind the scenes helps when something goes wron
## ExpressVPN
ExpressVPN emulates the flow used by the ExpressVPN browser extension: it authenticates
with cookies (or a cached token), obtains proxy-capable locations from ExpressVPN's API,
and returns an authenticated HTTPS proxy. Because it relies on browser cookies rather than
service credentials, setup is slightly more involved than the credential-based providers.
ExpressVPN mirrors the ExpressVPN Android TV app: it signs in through Express's OAuth 2.0
device-login flow, obtains proxy-capable locations from Express's API, and returns an
authenticated HTTPS proxy. The device login runs once; after that the cached refresh token
keeps the session alive headlessly.
ExpressVPN **auto-loads** if its cookie file exists, so once the cookie is in place you do
not strictly need a YAML block, but you can add one to pin regions or servers.
Enable it and run a download interactively once:
**Default file locations:**
```yaml title="unshackle.yaml"
proxy_providers:
expressvpn:
enable: true
```
| File | Default path |
|---|---|
| Browser cookies | `{cookies}/vpn/expressvpn.txt` |
| Token cache | `{cache}/global/expressvpn_tokens.json` |
Where `{cookies}` and `{cache}` are your configured cookie and cache directories. The
cookie file may be a Netscape `cookies.txt`, a JSON cookie array, or a JSON dict. Export
your ExpressVPN session cookies from a logged-in browser into one of those forms.
With `enable: true` and an interactive terminal, unshackle prints a code and a URL to
enter it at. Once approved, the tokens are cached and reused automatically, so later runs
need no terminal. ExpressVPN also **auto-loads** once its token cache exists, so you can
drop `enable` after the first login, but you can keep a YAML block to pin regions or
servers:
```yaml title="unshackle.yaml (optional)"
proxy_providers:
@@ -376,6 +376,14 @@ proxy_providers:
myserver: usny-newyork-2
```
**Default file location:**
| File | Default path |
|---|---|
| Token cache | `{cache}/vpn/expressvpn_tokens.json` |
Where `{cache}` is your configured cache directory.
**Query forms:**
| Query | Meaning |