Home > Article > Backend Development > How does curl simulate logging into an OAuth authorized user center to log in to each subsite below it?
How does curl simulate logging into an OAuth authorized user center to log in to each subsite below it?
- WBOYOriginal
- 2016-12-01 00:56:221395browse
Overview of the problem:
Simulate logging into a website such as http://www.aaa.com through php curl, and capture the packet through fiddler and analyze it as follows:
1. Submit the form to http://www.aaa.com in POST mode /dologin, a token is generated here: xxx,
2. The server jumps to the following address with this token to log in:https://account.usercenter.com/login?token=xxx&target_url=http://www .aaa.com；
(Note that the domain name is different and it is https. In addition, you can log in normally by copying the URL carrying the token to any computer. It will become invalid after the login is successful)
3. After the login is successful, the address is redirected to the target_url: http://www.aaa.com
Problem Analysis:
My understanding: There is an authorization server. Any PC accesses the URL carrying a valid token. This token is maintained through cookies between the PC and the server;
Ask a question:
How to implement this login simulation using php curl?
Here is my code:
<code><?php
$cookie_file = 'E:\work\cookie.txt';
$login_url = 'http://www.aaa.com/dologin';
$post_fields = 'userName=aa&password=bb&service_key=cc'
$post_fields.= '&callback_url=http%3A%2F%2Fwww.aaa.com&hostUrl=http%3A%2F%2Fwww.aaa.com';
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
//curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$contents=curl_exec($ch);
curl_close($ch);
preg_match('/(https:\/\/account\.usercenter\.com\/tokenLogin[^\s]*)\s*/',$contents,$match);
//var_dump($match);die; 此处匹配出携带token的url
$ch = curl_init($match[1]);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36 OPR/41.0.2353.46");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($ch);
curl_close($ch);
$url='http://www.aaa.com/1.html';
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
//curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36 OPR/41.0.2353.46");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
var_dump($contents);//这里输出的页面显示没有登陆成功（这里是问题所在）
?></code>
I wonder if this kind of login can be achieved through cookies? Dear heroes, please give me some advice~~
Reply content:
Overview of the problem:
Simulate logging into a website such as http://www.aaa.com through php curl, and capture the packet through fiddler and analyze it as follows:
1. Submit the form to http://www.aaa.com in POST mode /dologin, a token is generated here: xxx,
2. The server jumps to the following address with this token to log in:https://account.usercenter.com/login?token=xxx&target_url=http://www .aaa.com；
(Note that the domain name is different and it is https. In addition, you can log in normally by copying the URL carrying the token to any computer. It will become invalid after the login is successful)
3. After the login is successful, the address is redirected to the target_url: http://www.aaa.com
Problem Analysis:
My understanding: There is an authorization server. Any PC accesses the URL carrying a valid token. This token is maintained through cookies between the PC and the server;
Ask a question:
How to implement this login simulation using php curl?
Here is my code:
<code><?php
$cookie_file = 'E:\work\cookie.txt';
$login_url = 'http://www.aaa.com/dologin';
$post_fields = 'userName=aa&password=bb&service_key=cc'
$post_fields.= '&callback_url=http%3A%2F%2Fwww.aaa.com&hostUrl=http%3A%2F%2Fwww.aaa.com';
$ch = curl_init($login_url);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
//curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_fields);
$contents=curl_exec($ch);
curl_close($ch);
preg_match('/(https:\/\/account\.usercenter\.com\/tokenLogin[^\s]*)\s*/',$contents,$match);
//var_dump($match);die; 此处匹配出携带token的url
$ch = curl_init($match[1]);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36 OPR/41.0.2353.46");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($ch);
curl_close($ch);
$url='http://www.aaa.com/1.html';
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
//curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.59 Safari/537.36 OPR/41.0.2353.46");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$contents = curl_exec($ch);
curl_close($ch);
var_dump($contents);//这里输出的页面显示没有登陆成功（这里是问题所在）
?></code>
I wonder if this kind of login can be achieved through cookies? Dear heroes, please give me some advice~~
I have debugged how to carry cookies many times in the previous code, but it seems that it has never been successfully associated with the cookie file. I don’t know how to write the code to carry cookies. However, after more debugging, I found that after calling http://www.aaa.com/dologin, I can already log in to this site. This URL with the token is just an SSO, in order to log in to other sub-sites.
Thank you for your answers~~
Of course it can be achieved, your understanding is correct. A unique token is saved in the cookie, and the token must be carried every time it is submitted. After successful login, the token becomes invalid immediately.
According to the process, it must be right