Reverse engineering Javascript behind Google+ button

VICTORY! Well for me at least 😛. The SAPISIDHASH I was looking for was the one in the API console. Automation for rather large job, totally legitimate. The one I found was a SHA1 on the current JavaScript milliseconds timestamp plus your current SAPISID from your cookie plus the domain origin. In order for my request to work I had to include the following headers in the request:

Authorization:SAPISIDHASH 1439879298823_<hidden sha1 hash value>

and:

X-Origin:https://console.developers.google.com

The first header I assume tells the server your timestamp and your SHA1 value. The second (breaks if you don't include it) tells it the origin to use in the SHA1 algorithm. I found the algorithm by digging through and debugging the hell out of tons of minified JS NOTE there are spaces appended between the values. The psuedo code is basically:

sha1(new Date().getTime() + ' ' + SAPISID + ' ' + origin);

That is at least how I got my SAPISIDHASH value in my use case here in 2015 (few years later I know)... different from yours but maybe I will help some other young good hacker out there one day.

All credits to Dave Thomas.

I just want to clarify that for the X-Origin, or Origin, you do not include the "X-Origin:" or "Origin:"

Here is one example :

public class SAPISIDHASH {

    public static void main(String [] args) {

        String sapisid = "b4qUZKO4943exo9W/AmP2OAZLWGDwTsuh1";
        String origin = "https://hangouts.google.com";
        String sapisidhash = "1447033700279" + " " + sapisid + " " + origin;
        System.out.println("SAPISID:\n"+ hashString(sapisidhash));
        System.out.println("Expecting:");
        System.out.println("38cb670a2eaa2aca37edf07293150865121275cd");

    }

    private static String hashString(String password)
    {
        String sha1 = "";
        try
        {
            MessageDigest crypt = MessageDigest.getInstance("SHA-1");
            crypt.reset();
            crypt.update(password.getBytes("UTF-8"));
            sha1 = byteToHex(crypt.digest());
        }
        catch(NoSuchAlgorithmException e)
        {
            e.printStackTrace();
        }
        catch(UnsupportedEncodingException e)
        {
            e.printStackTrace();
        }
        return sha1;
    }

    private static String byteToHex(final byte[] hash)
    {
        Formatter formatter = new Formatter();
        for (byte b : hash)
        {
            formatter.format("%02x", b);
        }
        String result = formatter.toString();
        formatter.close();
        return result;
    }
}

source for sha1 in Java : Java String to SHA1

This works in 2024 for youtube (js with Deno runtime)

const now = new Date();
const origin = "https://studio.youtube.com";
const timems = now.getTime() + (now.getTimezoneOffset() * 60 * 1000)
const timesec = Math.round(timems / 1000);
const SAPISID = cookieArray['SAPISID']; // you should know how to get it
const newHash = timesec + '_' + sha1(timesec + ' ' + SAPISID + ' ' + origin, "utf8", "hex"); // this sha1 function is from deno package but you can use any other from the samples above
SAPISIDHASH = newHash; // 1704658177_78eb913fea82472cd726b118c51a6071f9d794f3

I use sha1 from deno but you can use any other realization for sha1 from samples above.

Today I also researched this latest calculation method, and the previous answers have already expired.

It has added a parameter "datasyncId" related to user login, which only requires searching for "datasyncId" or "DATASYNC ID" on the login page. It needs to take the second parameter for calculation.

datasyncId = "10438XXXXXXXXXXXXXXX2||10510XXXXXXXXXXXXXXX7"
timesec = str(int(time.time()))
SAPISID = "" # from cookies
origin = "https://studio.youtube.com"
hash = datasyncId.split("||")[1] + ' ' + timesec + ' ' + SAPISID + ' ' + origin
SAPISIDHASH = timesec + '_' + hashlib.sha1(hash.encode('utf-8')).digest().hex() + '_u'