Data posting isn't working in PHP Curl - php

Question

I'm trying to make a script that makes things easier for Apple users, I don't really want to expose it right now but those are the steps I need to follow.
Login to Apple and saving the cookies.
Getting the data from apple with the saved cookies.
Creating automation tools.
And i'm stuck in the first step, Curl isn't submitting the custom headers as I need to submit the json header.
Here is my code:
<?php
function login($url,$data){
$data=json_encode($data);
$login = curl_init();
curl_setopt($login, CURLOPT_COOKIEJAR, "cookie.txt");
curl_setopt($login, CURLOPT_COOKIEFILE, "cookie.txt");
curl_setopt($login, CURLOPT_NOBODY, false);
curl_setopt($login, CURLOPT_HEADER, false);
curl_setopt($login, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($login, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($login, CURLOPT_TIMEOUT, 40000);
curl_setopt($login, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($login, CURLOPT_URL, $url);
curl_setopt($login, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($login, CURLOPT_FOLLOWLOCATION, TRUE);
curl_setopt($login, CURLOPT_POST, TRUE);
curl_setopt($login, CURLOPT_POST, 1);
curl_setopt($login, CURLOPT_HTTPHEADER, array(
'Content-Type: application/json',
'Content-Length: ' . strlen($data))
);
curl_setopt($login, CURLOPT_POSTFIELDS, $data);
//ob_start();
$rez=curl_exec ($login);
}
$data = array("accountName" => "myemail#me.com", "password" => "MyPassWord","rememberMe" => "true");
$url="https://idmsa.apple.com/appleauth/auth/signin";
login($url,$data);
?>
Whenever I try tampering the data when sending request, it never shows the custom headers

Answer 1

Apple uses X-Apple-Widget-Key like CSRF. I think you need to catch it. You can find it on source code. You can get status by using curl_getinfo()
// your code .....
curl_setopt($login, CURLOPT_POSTFIELDS, $data);
//ob_start();
$rez = curl_exec($login);
$status = curl_getinfo($login);
print_r($status);

Answer 2

This would be unmanageable as a comment, so here is how i see what goes on the wire:
$verbiage = null;
if ($this->verbose) {
curl_setopt($ch , CURLINFO_HEADER_OUT , false);
curl_setopt($ch , CURLOPT_VERBOSE , true);
$verbiage = fopen('php://temp' , 'w+');
curl_setopt($ch , CURLOPT_STDERR , $verbiage);
}
$resp = curl_exec($ch);
if ($this->verbose) {
rewind($verbiage);
$verboseLog = stream_get_contents($verbiage);
$log->info("Verbose information:\n$verboseLog");
fclose($verbiage);
}
curl_close($ch);
where $log is a log4php object, you pick your display method.
EDIT adding a sample log with this 'trace' option enabled
INFO - testCreateLabRequest starts.
TRACE - Query for lab request [dispensary[1]inboundLabRequest[2]ForPatient[1]] returned no records for feed [toubibCreamedFeedGuid]
DEBUG - Sending json
{ *redacted* , "trackingId":"5ac4473b-407f-4d7d-83eb-1a3f9abe5b8b"}
INFO - Verbose information:
* Trying fe80::3636:3bff:fecf:804c...
* Connected to darkmax.local (fe80::3636:3bff:fecf:804c) port 80 (#0)
> POST /ehr/feed/lab/request HTTP/1.1
Host: darkmax.local
Protocol_version : 1.1
Connection: Close
Content-Type: application/json ; charset=utf-8
Proxy-Connection: Close
User-Agent: Portable EHR(106)
Accept: application/json, text/html;
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Content-Length: 851
* upload completely sent off: 851 out of 851 bytes
< HTTP/1.1 200 OK
< Date: Wed, 31 Aug 2016 02:04:03 GMT
< Server: Apachee/2.4.12
< Access-Control-Allow-Origin: *
< Origin: http://darkmax.local
< Connection: close
< Transfer-Encoding: chunked
< Content-Type: application/json; charset=utf-8
<
* Closing connection 0
The lines with a < correspond to what my cURL session is receiving from the remote peer. Having some visibility into the actual HTTP protocol flying from me-to-peer-back-to-me has helped me many times figure out the nature of some underlying issue.