XHR IG login

script.js

var params = "username=username&password=password";

new Promise(function (resolve, reject) {
  var http = new XMLHttpRequest();
  http.open("POST", "https://www.instagram.com/accounts/login/ajax/", true);
  http.setRequestHeader('x-csrftoken', window._sharedData.config.csrf_token);
  http.setRequestHeader('x-instagram-ajax', '1');
  http.setRequestHeader('x-requested-with', 'XMLHttpRequest');
  http.setRequestHeader("pragma", "no-cache");
  http.setRequestHeader("cache-control", "no-cache");
  http.setRequestHeader("accept-language", "en-US,en;q=0.8,it;q=0.6");
  http.setRequestHeader("content-type", "application/x-www-form-urlencoded");
  http.onreadystatechange = function () {
    if (http.readyState == 4 && http.status !== 200) {
      reject('error: ' + http.status);
    };
    if (http.readyState == 4 && http.status == 200) {
      var json = JSON.parse(http.response);
      if (!json.authenticated) {
        reject('bad password');
      } else if (json.authenticated && json.user && json.status === 'ok') {
        resolve('success:', document.cookie);
      };
    };
  };
  http.send(params);
});