How to get Cookie in request header while curl php - php

Question

I am trying to check login information for a website using curl php.
The Request header looks like this:
GET /loginpage.cgi HTTP/1.1
Host: test.com
Connection: keep-alive
pragma: no-cache
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Accept: */*
Referer: https://test.com/login.cgi
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.8
Cookie: QSESSIONID=**c0da73be1917324c157e5c45b1bccd4f**
The QSESSIONID value changes every time, I need this value to be passes in the header in order to make a curl request from php. My php code looks like:
<?php
$username = 'user';
$password = 'pass';
$url = "https://test.com/login.cgi?key=GetLoginUserInfo";
$ch = curl_init();
$headers = array();
$headers[] = "Pragma: no-cache";
$headers[] = "Accept-Encoding: gzip, deflate, br";
$headers[] = "Accept-Language: en-US,en;q=0.8";
$headers[] = "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36";
$headers[] = "Accept: */*";
$headers[] = "Referer: https://test.com/login.cgi?key=UDIT";
$headers[] = "Cookie: QSESSIONID=c0da73be1917324c157e5c45b1bccd4f";
$headers[] = "Connection: keep-alive";
$headers[] = "Cache-Control: no-cache, no-store, max-age=0, must-
revalidate";
$headers[] = "Expires: Fri, 01 Jan 1990 00:00:00 GMT";
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_USERPWD, "$username:$password");
$result = curl_exec($ch);
print_r($result);
$ch_error = curl_error($ch);
if ($ch_error) {
echo "cURL Error: $ch_error";
} else {
echo $result;
}
curl_close($ch);
?>
Now when I run this. When I get the session id from the dev tools request header and change it in my header then only I can log in, because the value changes every time some one login.
So my question is, is their a way I can get that value from the request header so that i can append that value in my header in php code. Or any other way that you can suggest, I am open for suggestions.
If i remove this information from php code the request fails, if

Answer 1

That looks like a session ID (the name kinda gives it away), these are generated on your first connection. You're supposed to store this and send this as a cookie in subsequent requests so the server can keep track of your session.
If you dont send this cookie header you will get a random one with every request.
This code is written in a way to attempt to teach you how cookies are handled. There are a lot of assumptions about what you are trying to do, but this gives you a basic understanding of how to parse/handle headers and the session ID.
I've avoided using a cookiejar (which is much easier and cleaner to code) because it automatically does all of this for you, i recommend you look into them once you learn how session ID's work.
<?php
class MyService
{
private $headers = [];
private $cookies = [];
private $loggedIn = false;
function login($username, $password)
{
$ch = curl_init('https://test.com/login.cgi');
#Assumption: Do whatever is needed for login here
curl_setopt($ch, CURLOPT_USERPWD, $username . ':' . $password);
# This is where we setup header processing
curl_setopt($ch, CURLOPT_HEADERFUNCTION, [$this, 'parseHeaders']);
#Assumption: Check for valid response
$response = curl_exec($ch);
$this->loggedIn = ($response == 'true');
curl_close($ch);
return $this->loggedIn;
}
function getHeader($header)
{
return array_key_exists($header, $this->headers) ? $this->headers[$header] : null;
}
function getCookie($cookie)
{
return array_key_exists($cookie, $this->cookies) ? $this->cookies[$cookie] : null;
}
function parseHeaders($ch, $header)
{
if (stristr($header, 'set-cookie')) {
# If you can install PECL pecl_http this will work better
// $this->cookies = http_parse_cookie(strstr('Set-Cookie', $header))['cookies'];
# Otherwise
$reserved_words = [
'httponly',
'expire',
'path',
'expires',
'domain',
'secure'
];
preg_match("/Set-Cookie: (.*)/", $header, $cookies);
foreach ($cookies as $cookie) {
$cookie = explode(';', $cookie);
foreach ($cookie as $cookie_part) {
$cookie_part = explode('=', $cookie_part);
array_walk($cookie_part, create_function('&$val', '$val = trim($val);'));
if (!in_array($cookie_part[0], $reserved_words) && isset($cookie_part[1])) {
$this->cookies[$cookie_part[0]] = $cookie_part[1];
}
}
}
} else {
$header_part = explode(':', $header, 2);
if (isset($header_part[1])) {
$this->headers[trim($header_part[0])] = trim($header_part[1]);
}
}
}
function otherInfo()
{
if (!$this->loggedIn) {
throw new NotLoggedInException('Login first');
}
$headers = []; # Populate whatever headers are mandatory
$url = "https://test.com/login.cgi?key=GetOtherInfo";
$ch = curl_init();
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'QSESSIONID=' . $this->getCookie('QSESSIONID'));
$result = curl_exec($ch);
curl_close($ch);
return $result;
}
function getUserInfo()
{
if (!$this->loggedIn) {
throw new NotLoggedInException('Login first');
}
$headers = []; # Populate whatever headers are mandatory
$url = "https://test.com/login.cgi?key=GetLoginUserInfo";
$ch = curl_init();
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIE, 'QSESSIONID=' . $this->getCookie('QSESSIONID'));
$result = curl_exec($ch);
curl_close($ch);
return $result;
}
}
$username = 'user';
$password = 'pass';
$api = new MyService();
$api->login($username, $password);
$info = $api->getUserInfo();
$other = $api->otherInfo();