Make the called url deal with client cookie not caller cookie - php

Question

I'm making an app that deal with an API
So i'm trying to call the API using cURL and the issue is that the api will deal with the server cookie which do this curl call not the client cookie who use the app...
For Example : the client is already logged in to the api ,
but when i check if the client logged in by curl call , the api response that you are not authorithed
So how can i make the API deal with the client cookies or pass the cookie of client to the API ?

Answer 1

You'll want to use a cookiefile, like so:
# Set the cookiefile name, which will allow us to store the cookie and present it later for all requests that require it...
$cookiefile = tempnam("/tmp", "cookies");
$agent = "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)";
# Set the user name and password values
$user = $argv[1];
$password = $argv[2];
# The API url, to do the login
$url = "https://some_site.com/login.php?WID=$user&PW=$password";
# Initialise CURL
$ch = curl_init();
# Set all the various options
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_userAGENT, $agent);
curl_setopt($ch, CURLOPT_POST, 0); // set POST method
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiefile);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiefile);
curl_setopt($ch, CURLOPT_userPWD, $user.":".$password);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
# Execute the first CURL request to perform the login...
$results = curl_exec($ch);
# Setup our next request...
$job_id_number = $argv[3];
$url = "https://some_site.com/request.php?task=add&taskID=$job_id_number";
# We do not have to initialise CURL again, however we do need to adjust our URL option for the second request...
curl_setopt($ch, CURLOPT_URL, $url);
#Remember to use the same cookiefile as above
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookiefile);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookiefile);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
# Execute the second CURL call to perform the action (using the cookie we retrieved from earlier)
$results = curl_exec($ch);
echo "$results";

Answer 2

You should check the documentation of the API.
Maybe the documentation describes a way to authorize the client.
This way it won't work, because the cookies are set at clientside (in the browser) and not at your server. So when you make a cURl call, the cookie data isn't included in the request.
An API call via Javascript could work, because that is a request that the client sends (with the needed cookies)