如何在单个cURL请求中获取和发布信息？

Question

Is it possible to get the value of an input and also post information in the same cURL request?

Reason: I am trying to login here using cURL, however, the login form generates a unique key in the value of the input named form_key . So, I want to first get that value then post the username and password to successfully login.

PHP (not working, gives a blank page with nothing in source code):

$ch2 = curl_init();
curl_setopt($ch2, CURLOPT_URL, "https://b2b.chiemsee.com/customer/account/login/");
curl_setopt($ch2, CURLOPT_FOLLOWLOCATION, true); // to allow redirections
//curl_setopt($ch2, CURLOPT_SSL_VERIFYPEER, FALSE); // to avoid error
curl_setopt($ch2, CURLOPT_POST, true); // to send info
curl_setopt($ch2, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch2, CURLOPT_COOKIEJAR, 'cookie.txt'); // to save cookie data for login
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true); // to get the html
$response2 = curl_exec($ch2);
curl_close($ch2);

$html = new simple_html_dom();
$html->load($response2);

$val = $html->find('input[name=form_key]');
$form_key = $val[0]->value;

$data = array(
    'form_key' => $form_key,
    'login[username]' => 'myusername',
    'login[password]' => 'mypassword',
    'send' => '',
);

PS When I login manually and check the browser console -> network -> post -> headers/parameters, I get the following:-

form_key: viiRqZigH0YPC9wu
login[username]: myusername
login[password]: mypassword
send: 

UPDATE. TWO SEPARATE cURL REQUESTS (still now working):

include('simple_html_dom.php');

$ch2 = curl_init();
curl_setopt($ch2, CURLOPT_URL, "https://b2b.chiemsee.com/customer/account/login/");
curl_setopt($ch2, CURLOPT_FOLLOWLOCATION, true); // to allow redirections
curl_setopt($ch2, CURLOPT_COOKIEJAR, 'cookie.txt'); // to save cookie data for login
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true); // to get the html
$response2 = curl_exec($ch2);
curl_close($ch2);

$html = new simple_html_dom();
$html->load($response2);

$val = $html->find('input[name=form_key]');
$form_key = $val[0]->value;

$data = array(
    'form_key' => $form_key,
    'login[username]' => 'myusername',
    'login[password]' => 'mypassword',
    'send' => 'Anmelden'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://b2b.chiemsee.com/customer/account/login/");
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); // to allow redirections
//curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // to avoid error
curl_setopt($ch, CURLOPT_POST, true); // to send info
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt'); // to read data
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // to get the html
$response = curl_exec($ch);
if (curl_error($ch)) {
    $error_msg = curl_error($ch);
    var_dump($error_msg);
    exit;
}
curl_close($ch);
echo $response;

Answer 1

So a bit of an intro of what's going on.

form_key seems to be used as a form of CSRF protection specifically it is a synchronizer token .

In short what happens is, a user visits a web page, the web page creates a session for the user and generates a unique token. The server then attaches that unique token to the form as a hidden field. When a user submits that form then it is submitted with that hidden field and the server can cross-reference that the token received is the same as the one that was sent.

However the critical part is that the server needs to be aware of who the user is, and that is done through the session. The session is maintained via a session cookie, which is why the session cookie is necessary.

To correctly simulate a real user you need to store the cookies the server sends you on first visit, this is done using the CURLOPT_COOKIEJAR :

$ch2 = curl_init();
curl_setopt($ch2, CURLOPT_URL, "https://b2b.chiemsee.com/customer/account/login/");
curl_setopt($ch2, CURLOPT_FOLLOWLOCATION, true); // to allow redirections
//curl_setopt($ch2, CURLOPT_SSL_VERIFYPEER, FALSE); // to avoid error
curl_setopt($ch2, CURLOPT_POST, true); // to send info
curl_setopt($ch2, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch2, CURLOPT_COOKIEJAR, 'cookie.txt'); // to save session cookie
curl_setopt($ch2, CURLOPT_RETURNTRANSFER, true); // to get the html
$response2 = curl_exec($ch2);
curl_close($ch2);

after you've done this and retrieved the CSRF token by scraping the page you need to submit this along with the corresponding cookies:

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://b2b.chiemsee.com/customer/account/loginPost/"); //Make sure you have the correct URL
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); // to allow redirections
//curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); // to avoid error
curl_setopt($ch, CURLOPT_POST, true); // to send info
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt'); // to read cookie data
curl_setopt($ch2, CURLOPT_COOKIEJAR, 'cookie.txt'); // optional, this will update existing cookies and add new ones if needed.
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // to get the html
$response = curl_exec($ch);
if (curl_error($ch)) {
    $error_msg = curl_error($ch);
    var_dump($error_msg);
    exit;
}
curl_close($ch);
echo $response;

This should allow the server to load the correct session for which the CSRF token was created in the first place and then verify that token you're sending.

As a sidenote: The reason for the token is simple. If I make a webpage which tricks users to post directly to another webpage this token is a piece of data that I can never have access to as it is only shared with the user directly so 3rd parties can't access it. It might make automations such as yours harder to implement but it is very effective for user security.

Answer 2

What you're asking is not possible. Not because of cURL or PHP limitations, but simply because of causality. Consider the logical set of steps being performed. In order to send the login request, you must first know the form_key . In order to know the form_key you must first request the login page.

To put it simply, you can't make use of information that you don't have yet.

• Make the first HTTP request to get the form information. (Specifically the form_key value that you need.)
• Make the second HTTP request to send the login information, including the data you fetched from the first request.

There's no reason to try to do this in a single step.