PHP curl cannot save ASP.net MVC generated cookie
发布于2023-05-25 21:37 阅读(142) 评论(0) 点赞(10) 收藏(0)
I need to write a bot to login into a website and do some query, problem is this website is written in ASP.NET MVC and needs two cookies to identify user! I can save one cookie using my PHP curl but the other one .AspNet.ApplicationCookie (which is as large as ~400KB) cannot be stored!
Here is my code:
$ch = curl_init('MY URL...');
$cookie = __DIR__ . '/cookie.txt';
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/32.0.1700.107 Chrome/32.0.1700.107 Safari/537.36');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, "UserName=123&Password=123");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie);
$result = curl_exec($ch);
var_dump($result);
解决方案
I found the solution, ASP.net uses a mechanism to avoid CSRF attacks which is using a token field (hidden text input as "__RequestVerificationToken") and a cookie on the same page also as "__RequestVerificationToken" these tokens comes with different values but are related with each other, what you need to do for a remote login using PHP cURL is to fetch these values at the same time and posting them together if you get the __RequestVerificationToken field and get the cookie another time or vice versa, ASP.net considers this as an attack and changes values both on cookie and the field which will result to a failed login.
所属网站分类: 技术文章 > 问答
作者：黑洞官方问答小能手
链接：http://www.phpheidong.com/blog/article/546155/32d2d80469f25c7082a7/
来源：php黑洞网
任何形式的转载都请注明出处,如有侵权 一经发现 必将追究其法律责任
昵称:
评论内容：(最多支持255个字符)
---无人问津也好，技不如人也罢，你都要试着安静下来，去做自己该做的事，而不是让内心的烦躁、焦虑，坏掉你本来就不多的热情和定力