PHP - How do i put the X-CSRF-TOKEN in the headers? - php

Question

How do I put the $token or x-csrf-token to headers?
The curl post works when I put x-csrf-token in the headers manually.
What should I do to put the $token or x-csrf-token automaticly to headers?
When I make a new curl post that gets token and when I put the token automatic on the headers the response of the curl is 404 bad request
This is my script:
$Thing = $_GET['Thing'];
$username = $_GET['username'];
$password = $_GET['password'];
$login = array(
"cvalue" => $username,
"ctype" => "Username",
"password" => $password,
"captchaToken" => $Thing,
"captchaProvider" => "PROVIDER_ARKOSE_LABS"
);
$curl = curl_init('https://auth.roblox.com/v2/login'); // There are many links you can login from
curl_setopt_array($curl,array(
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POST => true,
CURLOPT_SSL_VERIFYPEER => true,
CURLOPT_POSTFIELDS => json_encode($login),
CURLOPT_HEADER => true,
CURLOPT_CONNECTTIMEOUT => 5,
CURLOPT_TIMEOUT => 5,
CURLOPT_HTTPHEADER => array(
'Content-Type: application/json; charset=utf-8',
'Accept: application/json, text/plain, */*',
'X-CSRF-TOKEN: '
),
CURLOPT_USERAGENT,'Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'
));
$response = curl_exec($curl);
$size = curl_getinfo($curl,CURLINFO_HEADER_SIZE);
curl_close($curl);
#$response1 = explode(" ", $response);
#$cookie = $response1[10];
#$search = ".ROBLOSECURITY=";
#$cookie1 = str_replace($search, '', $cookie);
$headers = substr($response,0,$size);
$array = explode("\n",$headers);
foreach($array as $data){
if(strpos($data,'csrf')){
$info = explode(' ',$data);
break;
}
}
$csrf = $info[1];
$token = $csrf;
print_r($token);
print_r($response);

Answer 1

There isn't a way to automatically attach custom headers to all CURL requests. The best way is to wrap your CURL code inside a function and pass the desired CSRF token as a parameter. Here's a demo:
function curl_call(array $params, string $csrf_token)
{
... curl code here...
'X-CSRF-TOKEN: '. $csrf_token,
... remaining curl code here...
}
Then when you want to make a CURL request, you may call the function like this:
curl_call(['url' => '...', etc], 'csrf token string here');