使用curl登录https网站

Question

i am trying to login to a site. this site use auto submit from and a random key for submitting form. i have tried several ways but couldn't get through. so here is my codes. any answer will be appreciated. thanks in advance. also my fake account pass and username available in code for those who wants to give a try. my url is little bit long

include 'simple_html_dom.php';
$i = 0;
$html = file_get_html($url);
foreach($html->find('input') as $keys) {
    $ltkey = $keys->value;
    if (++ $i == 1)
        break;
}
$url = 'https://auth.station.sony.com/login?theme=poxnora&cid=1056360&service=https://poxnora.station.sony.com/cas/merge.do&regService=https://poxnora.station.sony.com /play/load.do';
$data = 'lt=' . $ltkey . '&_eventId=submit&username=XXXXXXXX&password=XXXXXXXX';

// curl request
$fp = fopen("cookie.txt", "w");
fclose($fp);
$login = curl_init();
curl_setopt($login, CURLOPT_COOKIEJAR, "cookie.txt");
curl_setopt($login, CURLOPT_COOKIEFILE, "cookie.txt");
curl_setopt($login, CURLOPT_TIMEOUT, 40000);
curl_setopt($login, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($login, CURLOPT_URL, $url);
curl_setopt($login, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
curl_setopt($login, CURLOPT_FOLLOWLOCATION, TRUE);
curl_setopt($login, CURLOPT_POST, TRUE);
curl_setopt($login, CURLOPT_POSTFIELDS, $data);
curl_setopt($login, CURLOPT_SSL_VERIFYPEER, TRUE);
curl_setopt($login, CURLOPT_SSL_VERIFYHOST, 2);
    curl_setopt($login, CURLOPT_CAINFO, "cert.crt");
$result = curl_exec($login);
curl_close($login);

echo $result;

Answer 1

The problem is the form key is connected to a session. So you need to use your cookie file when you are retrieving the form key. Here's how I would do it:

<?php

class PoxnoraAPI {
    const URL = 'https://auth.station.sony.com/login?theme=poxnora&cid=1056360&service=https://poxnora.station.sony.com/cas/merge.do&regService=https://poxnora.station.sony.com /play/load.do';

    protected $cookieFile;

    public function __construct() {
        // create a new cookie file
        $this->getCookieFile();
    }

    // Creates new cookie file in system temp dir
    protected function getCookieFile() {
        $this->cookieFile = tempnam(sys_get_temp_dir(), 'CDL');
    }

    // Gets form key from login page
    protected function getFormKey() {
        $ch = curl_init();
        $this->setCurlOpts($ch);
        $result = curl_exec($ch);
        curl_close($ch);

        $key = $this->matchFormKey($result);

        if (!$key) {
            throw new Exception('Unable to get key from form');
        }

        return $key;
    }

    protected function matchFormKey($result) {
        preg_match_all('<input type="hidden" name="lt" value="(.*)">', $result, $matches);

        return isset($matches[1][0]) ? $matches[1][0] : false;
    }

    // Uses username, password, and form key to login
    public function login($username, $password) {
        $key = $this->getFormKey();

        $ch = curl_init();
        $this->setCurlOpts($ch);

        $data = "lt=$key&_eventId=submit&username=$username&password=$password";
        $this->setCurlPost($ch, $data);

        $result = curl_exec($ch);
        curl_close($ch);

        // check if there's a form key. If there's a form key then we're on
        // the login page again
        $key = $this->matchFormKey($result);

        return !$key;
    }

    // Add post data to curl
    protected function setCurlPost($ch, $postData) {
        curl_setopt($ch, CURLOPT_POST,       true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $postData);
    }

    // Add default curl params
    protected function setCurlOpts($ch) {
        curl_setopt($ch, CURLOPT_COOKIEJAR,      $this->cookieFile);
        curl_setopt($ch, CURLOPT_COOKIEFILE,     $this->cookieFile);
        curl_setopt($ch, CURLOPT_TIMEOUT,        40000);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_URL,            self::URL);
        curl_setopt($ch, CURLOPT_USERAGENT,      $_SERVER['HTTP_USER_AGENT']);
        curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
        curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
        curl_setopt($ch, CURLOPT_REFERER,        self::URL);
    }
}

$api = new PoxnoraAPI();
$isLoggedIn = $api->login('USERNAME_HERE', 'PASSWORD_HERE');

if ($isLoggedIn) {
    echo '<h1>Successfully logged in!<h1>';
} else {
    echo '<h1>Error logging in</h1>';
}