curl: keep cookies while being redirected - php

Question

I use this code (originally found login into webpage with php with cURL) to first grab the csrf token, create cookie, and than use that csrf token and cookie in a subsequent post request. It doesn't work(deduced from how the final webpage looks) and I think it's because the FOLLOWLOCATION is set to true. It must be set to true, because there are some redirections going on, but redirections also bring the consequence of "misplacing" cookies. The question is..how to keep cookies while being redirected as a response from server.
$cookie = 'cookies2.txt';
# Initialize a cURL session.
$ch = curl_init('https://example.com/login');
# Set the cURL options.
$options = [
CURLOPT_COOKIEJAR => $cookie,
CURLOPT_RETURNTRANSFER => 1,
CURLOPT_USERAGENT => $useragent,
CURLOPT_COOKIESESSION => true,
CURLINFO_HEADER_OUT => true,
CURLOPT_HEADER=>1
];
# Set the options
curl_setopt_array($ch, $options);
# Execute
$html = curl_exec($ch);
$request = curl_getinfo($ch, CURLINFO_HEADER_OUT);
echo "1.Request sent: $request<br>";
$headerSizeFirst = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$headersFirst = substr($html, 0, $headerSizeFirst);
echo "1.Request recieved: $headersFirst";
$dom = pQuery::parseStr($html);
$csrfToken = $dom->query('[name="csrf"]')->val();
$postData = [
'csrf' => $csrfToken,
'username' => $email,
'password' => $password
...........
];
# Convert the post data array to URL encoded string
$postDataStr = http_build_query($postData);
$options[CURLOPT_POST] = 1;
$options[CURLOPT_POSTFIELDS] = $postDataStr;
$options[CURLOPT_HEADER]=1;
$options[CURLOPT_COOKIEJAR]=$cookie;
$options[CURLOPT_FOLLOWLOCATION] = true;
$options[CURLOPT_RETURNTRANSFER] = true;
$options[CURLOPT_USERAGENT] = $useragent;
$options[CURLINFO_HEADER_OUT] => true,
curl_setopt_array($ch, $options);
# Execute
$response = curl_exec($ch);
$request = curl_getinfo($ch, CURLINFO_HEADER_OUT);
echo "2. Request sent: $request<br>";
$headerSize = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
$headers = substr($response, 0, $headerSize);
echo "2. Request recieved: $headers<br>";
echo $response;
/////// HEADER OUT AND IN DATA
1.Request sent: GET /login HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: */*
1.Request recieved: HTTP/1.1 200 OK Accept-Ranges: bytes Age: 0 Cache-Control: no-cache Content-Type: text/html; charset=UTF-8 Date: Tue, 09 Feb 2016 13:34:02 GMT Server: nginx Set-Cookie: ____ri=4485; expires=Thu, 17-Mar-16 01:34:01 GMT; path=/; domain=.example.com Set-Cookie: PHPSESSID=dk7n4kcrigi54q081tr1evd5a2; path=/; domain=.example.com Set-Cookie: ts1=11e2bb0a86bfb9669c361cc407e1e3b3decefcce; expires=Fri, 06-Feb-2026 13:34:01 GMT; path=/; domain=.example.com Set-Cookie: session=eyJpdiI6Im9cL1wvcWVUUEhDVWY5cnF2QnZzVDRIaElPWitIQmc4RVI3N1M2SGxsY3hUTT0iLCJ2YWx1ZSI6InZjVFBnelNlMmxuaXpVNlpGb2d0TzNoM21NXC85dG43cVpmbUZkQ1VuOHlnU1VOXC9XWDJaWTcxckZ2OWpZY093REd1WmZEd21FQURQNnQ3NDltMmU0NnZMWm9vSE40YmV0VG1WYkpndE9DNTdEUE4wSkp5Q1BWMXJGaFdmMHV5N0NWRmZoVHFnT0JtY1VnYjJ6N29UZkxvQThRWG9KWFV3Q0k4azdibEZvVGwrcFJRaXdaQVV4OXZLaWlDVVpmeVREc3k3cW1MOTdTdHEyY1FlZ2Vuc09WWHFOanNOTjlnK1c0SStuTWhoU0VBWGxsY1ZqRExTblBOWllpeDNqaHhZNSIsIm1hYyI6IjllMWNhMzU3NTVjYTA4NWIwZTQ0NTYxMzA3ZmIzMTAxMWE5NDg0NzZlMTNmZTc2NjhhNDI2M2ZmZDMwMzgwY2QifQ%3D%3D; expires=Fri, 19-Feb-2016 13:34:02 GMT; path=/; domain=.example.com; httponly Vary: Accept-Encoding Vary: Accept-Encoding, Accept-Encoding X-Cache: Miss X-Frame-Options: SAMEORIGIN Content-Length: 51381 Connection: keep-alive
2. Request sent: GET /inx/aeGDrYQ HTTP/1.1 Host: example.com User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: */* Cookie: PHPSESSID=t762fd0nbi1bp3hrgb9sgc3k20; ____ri=4485; safemode=1; session=eyJpdiI6Im1HQzlNR1JhMTNDc0JRelYyRVwveUp6N0JxZG56Z2p5K094eSs3YU5HQ3dzPSIsInZhbHVlIjoiVXBPYzN4TVNReURhVnMxQlZ1TndLZ0dYUjltbUVEcW11bkJJMDdMRVZoZ0hHMjRXZ2p6azlcL1FWXC93NnZWN3oreDcxQms3aGlcL3l0MG1vTjd1V21FcmVCVzFnQjVuMUY5dHBWeUlTbU9NSjJcL1d5TlwvTW11ZWp1eHpNd3d4eFZTamV6aThsNldkdlN3aFo0XC9sTnVnU0tXVDRKbWVBU25VU0hJaDREQ1J5M2xDXC9zRUc5OXhWMWJWWG9jYndhczYyZW4xMkUxb3BoU3FmQmMrNVdzM3RqQmgzeHY1NVJ5RXRTNGZOdmQ4dTRCbmRtWVZBN210QVVEVk1BNTFPc1NQcFU3bnd4NEpKbnRaTFliRWNzbkZaXC9YWUF1Nld1ekZSbjVGRXBuZzNoRlBNND0iLCJtYWMiOiI4OWEwNmMyZGVkYjFiYTlmNDY0MDE5MTQwNzE1YzNhYWJjYTA5YjI3MWMyZjgwMTViN2MyYmI0OWUyNmMwNjM0In0%3D; toastMsg=2; ts1=11e2bb0a86bfb9669c361cc407e1e3b3decefcce
2. Request recieved: HTTP/1.1 302 Found Accept-Ranges: bytes Age: 0 Cache-Control: no-cache, private Content-Type: text/html; charset=UTF-8 Date: Tue, 09 Feb 2016 13:34:04 GMT location: http://example.com/inx/aeGDrYQ Server: nginx Set-Cookie: PHPSESSID=thrn81mu7584dvp2ek9tpde8f4; expires=Thu, 09-Feb-2017 13:34:03 GMT; path=/; domain=.example.com Set-Cookie: PHPSESSID=t762fd0nbi1bp3hrgb9sgc3k20; expires=Thu, 09-Feb-2017 13:34:03 GMT; path=/; domain=.example.com Set-Cookie: session=eyJpdiI6Im1HQzlNR1JhMTNDc0JRelYyRVwveUp6N0JxZG56Z2p5K094eSs3YU5HQ3dzPSIsInZhbHVlIjoiVXBPYzN4TVNReURhVnMxQlZ1TndLZ0dYUjltbUVEcW11bkJJMDdMRVZoZ0hHMjRXZ2p6azlcL1FWXC93NnZWN3oreDcxQms3aGlcL3l0MG1vTjd1V21FcmVCVzFnQjVuMUY5dHBWeUlTbU9NSjJcL1d5TlwvTW11ZWp1eHpNd3d4eFZTamV6aThsNldkdlN3aFo0XC9sTnVnU0tXVDRKbWVBU25VU0hJaDREQ1J5M2xDXC9zRUc5OXhWMWJWWG9jYndhczYyZW4xMkUxb3BoU3FmQmMrNVdzM3RqQmgzeHY1NVJ5RXRTNGZOdmQ4dTRCbmRtWVZBN210QVVEVk1BNTFPc1NQcFU3bnd4NEpKbnRaTFliRWNzbkZaXC9YWUF1Nld1ekZSbjVGRXBuZzNoRlBNND0iLCJtYWMiOiI4OWEwNmMyZGVkYjFiYTlmNDY0MDE5MTQwNzE1YzNhYWJjYTA5YjI3MWMyZjgwMTViN2MyYmI0OWUyNmMwNjM0In0%3D; expires=Fri, 19-Feb-2016 13:34:04 GMT; path=/; domain=.example.com; httponly Set-Cookie: toastMsg=2; expires=Fri, 08-Feb-2019 13:34:04 GMT; path=/; domain=.example.com Set-Cookie: unverified=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.example.com; httponly Set-Cookie: safemode=1; expires=Fri, 19-Feb-2016 13:34:04 GMT; path=/; domain=.example.com Set-Cookie: cacheableGrace=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.example.com; httponly X-Cache: Miss X-Frame-Options: SAMEORIGIN Content-Length: 0 Connection: keep-alive HTTP/1.1 200 OK Age: 0 Cache-Control: max-age=0, public, s-maxage=60 Content-Type: text/html; charset=UTF-8 Date: Tue, 09 Feb 2016 13:34:05 GMT Server: nginx Vary: Accept-Encoding Vary: Accept-Encoding X-Cache: Miss X-Cacheable: Yes X-Frame-Options: SAMEORIGIN transfer-encoding: chunked Connection: keep-alive

Answer 1

CURLOPT_COOKIESESSION set to true means you tell libcurl to treat this as a new (cookie) session and it will discard all session cookies at start of a request. You should probably not set that without being really sure that's what you need as it will flush all cookies without a specific expiry date/time.
Otherwise, when the cookie engine has been activated in libcurl it will keep the cookies associated with the handle and reuse them in subsequent requests done with that same handle.