使用 Curl 向 Shopify 发送 POST 请求

Question

I am making an API call to Shopify using this code. Previously this has worked fine.

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://me.myshopify.com/admin/orders/123456789/fulfillments.json');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $my_json);
curl_setopt($ch, CURLOPT_USERPWD, 'my_key:my_password');

curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-type: application/json',
    'Accept: application/json'
));

$result = curl_exec($ch);
curl_close($ch);

I am now getting back an error:

For security reasons, requests using HTTP Basic Authentication cannot include cookies

If I look at the Shopify manual at https://shopify.dev/tutorials/authenticate-a-private-app-with-shopify-admin#make-authenticated-requests then I see this:

Shopify doesn't support cookies in POST requests that use basic HTTP authentication. 
Any POST requests that use basic authentication and include cookies will fail with a 200 error code. 
Using cookies with basic authentication can expose your app to CSRF attacks, such as session hijacking.

How can I adjust my Curl request to ensure that no cookies are included?

Answer 1

As per your question specification and link shared regarding it, I think you using the private APP to access the Shopify store data, right?

if yes then as per my understanding regarding the Shopify API and its auth process you need to try something like this to make the request.

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://my_key:my_password@me.myshopify.com/admin/api/2021-01/orders/123456789/fulfillments.json');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $my_json);

curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'Content-type: application/json',
    'Accept: application/json'
));

$result = curl_exec($ch);
curl_close($ch);

This is the format according to API data on documentation page:
https://{username}:{password}@{shop}.myshopify.com/admin/api/2021-01/shop.json

If your HTTP client doesn't support basic authentication using this method, then you can provide the credentials in the Authorization header field instead:

Private apps can authenticate with Shopify by including the request header X-Shopify-Access-Token: {access_token} , where {access_token} is replaced by your private app's Admin API password.