PHP cURL身份验证问题

Question

我使用HttpFox并将值(url和post数据)与我的代码生成的值进行了比较.它们完全相同,但我总是在网页上看到"登录失败"的消息.我不知道可能是什么问题.

码:

require 'domparser_1_5/simple_html_dom.php';

$username = "username";
$password = "password";

function login($url,$data){
    $fp = fopen("cookie.txt", "w");
    fclose($fp);
    $login = curl_init();
    curl_setopt($login, CURLOPT_URL, $url);
    curl_setopt($login, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($login, CURLOPT_COOKIEJAR, "cookie.txt");
    curl_setopt($login, CURLOPT_COOKIEFILE, "cookie.txt");
    curl_setopt($login, CURLOPT_TIMEOUT, 40000);
    curl_setopt($login, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($login, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
    curl_setopt($login, CURLOPT_FOLLOWLOCATION, true);
    curl_setopt($login, CURLOPT_POST, true);
    curl_setopt($login, CURLOPT_POSTFIELDS, $data);
    ob_start();
    $result = curl_exec($login);
    ob_end_clean();
    curl_close($login);
    unset($login);
    return $result;
}

function generate_pass($user, $password, $token) {
    if ($password) {
        $enc_pass = md5($password);
        $pass = $user.':'.$enc_pass.':'.$token;
        return md5($pass);
    }
}

function get_token() {
    $html = file_get_html('https://www.foo.com/');
    $token = "";
    foreach($html->find('input') as $element) {
        if($element->name == "token") {
            $token = $element->value;
        }
    }
    if (!$token) {
        die('No token found');
    }
    return $token;
}

$token = get_token();

echo login("https://www.foo.com/login/start.html", "user=".$username."&password=".$password."&submit=Anmelden&logintype=login&pid=4%2C93%2C1828&pass=".generate_pass($username, $password, $token)."&redirect_url=login%2Fstart.html&tx_felogin_pi1%5Bnoredirect%5D=0&token=".$token."");

Answer 1

由于传递的 cookietoken不匹配，身份验证失败。

当您加载页面以检索令牌时，服务器会向get_token()您发送一个您未保存的 cookie。

稍后，当您尝试登录时，服务器期望收到与您收到token. 但你不发送它。

我建议您使用curl重写get_token()并将cookie存储在cookie.txt. 这样您以后打电话时就可以通过它们login()

像这样：

function get_token() {
    $url = 'https://www.foo.com/';
    $curl = curl_init();
    curl_setopt($curl, CURLOPT_URL, $url);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl, CURLOPT_COOKIEJAR, "cookie.txt");
    curl_setopt($curl, CURLOPT_COOKIEFILE, "cookie.txt");
    curl_setopt($curl, CURLOPT_TIMEOUT, 40000);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($curl, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
    curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
    $result = curl_exec($curl);
    curl_close($curl);
    unset($curl);

    $html = str_get_html( $result );
    $token = "";
    foreach($html->find('input') as $element) {
        if($element->name == "token") {
            $token = $element->value;
        }
    }
    if (!$token) {
        die('No token found');
    }
    return $token;
}

重要的：

消除

$fp = fopen("cookie.txt", "w");
fclose($fp);

因为login()这会将文件截断为零字节cookie.txt，并且您不想删除刚刚检索到的 cookie。

请注意，curl_exec()如果指定的 cookie 文件不存在，则创建该文件。