Posting from PHP to PHP - php

Question

I am working on creating a system which is secured by passing tokens from page to page to verify the validity of requests. The token is to be generated on the login page (as it only needs to be generated once) and then passed through to the main page. However, there is an intermediate PHP script which is being run to log the user in, and I am not sure how to take the posted token and pass it on to the main page.
In short, I need to post the token from the login page to the intermediary script, and then from the script to the main page, and I'm not sure how to do that.

Answer 1

If all 3 pages are on the same host, use a cookie or a session.

Answer 2

Store the data in a cookie/session instead:
session_start();
$_SESSION['token'] = 'yourTokenHere'
See PHP Sessions

Answer 3

I wrote this a long time ago:
function postheader($url, $server, $cookies, $daten)
{
$temp=array();
$out = "POST ".$url." HTTP/1.1\r\n";
$out .= "Host: ".$server."\r\n";
if(count($cookies)>0)
{
$out .= "Cookie: ";
foreach($cookies as $name=>$value)
{
$temp[] = $name."=".$value;
}
$out .= implode("; ",$temp);
$out .= "\r\n";
}
$out .= "User-Agent: Mozilla/4.0\r\n";
$out .= "Content-type: application/x-www-form-urlencoded\r\n";
$temp=array();
foreach($daten as $key=>$data)
{
$temp[] = $key."=".urlencode($data);
}
$temp=implode("&",$temp);
$out .= "Content-Length: ".strlen($temp)."\r\n";
$out .= "\r\n";
$out .= $temp."\r\n";
return $out;
}
$fp = fsockopen($server, 80, $errno, $errstr, 30);
if (!$fp)
die( "$errstr ($errno)<br />\n");
$out=postheader($url, $server, $cookies, $daten);
//echo $out;
fwrite($fp, $out);
while (!feof($fp))
{
$string.= fgets($fp, 128);
}
fclose($fp);
$daten should be a one dimensional associative array containing the data you want to send via the post request. For cookies, just add an empty array.
$server is the host address, and $url is only the address on the server, e.g.
$server="stackoverflow.com";
$url="/post.php";
$string will contain the whole response including the headers. If you don't want them, do a substring from the first "\r\n\r\n" occurence.

Answer 4

You can use Client side cookies:
<?php
setcookie("token", $myToken);
?>
The biggest fault with this method is that it absolutely requires the user to have cookies enabled on their browser. In highly secure situations a user may not have cookies enabled so this method wouldn't work for them.
Use $_SESSION global variable:
<?php
$_SESSION['token'] = $myToken;
?>
As previous variant, it requires cookies to be enabled.
Add $_GET parameter to URI string:
http://example.com?token=f4FArqk53Gwr4fESC73FedG48Trd3YEj
The biggest fault of this method is that your URI string will look very complex.
Also state information will be lost if user will manually modify URI.
Or pass everything in Hidden form fields:
Unfortunately it requires you to submit a form on every page.
You can do it with jQuery.
Some examples are here.

Answer 5

On further consideration, it looks like I was making things much more complicated than they needed to be. Thank you all for your help, but the solution seems to be that I should be a bit more intelligent.