cURL setopt cookies

[53329]

I can't seem to get CURLOPT_COOKIE or CURLOPT_COOKIEJAR to work.  So the first is self explanatory: I can't get it to send cookies because I can't find the syntax anywhere.  However cookiejar confuses me.  I get no error messages and no result in the file I assigned.  I even gave the file and directory write permission and had that php script used fopen to create it to see if that was the problem.

 

Also do either of these work with session cookies as well?

 

Thanks for any help.

[gkh01]

Is it better to post a question in similar but older topic, or start a new one?

In any event, I could not figure out how to post a new topic, so here goes...

 

I have a function "Redirect", as shown below (comments and error-checking removed for brevity):

 

From the little research I've done, I thought that setting the CURLOPT_COOKIEJAR and CURLOPT_COOKIEFILE options as I have done would make the current session cookie available in the redirected page. But it is not, and nothing appears to be written to curl_cookies.txt.  It then tried creating the file in case cURL could/would not do it, and I set the file has permissions 666 so that it can be read and written to. It is under the home directory so it cannot be browsed to. Did I not specify the path correctly?

 

function Redirect($url, $postinfo) 
{ 
    $curlh = curl_init(); 
    curl_setopt($curlh, CURLOPT_URL, $url); 

    if(isset($postinfo)) 
    { 
        curl_setopt($curlh, CURLOPT_POST, 1); 
        curl_setopt($curlh, CURLOPT_POSTFIELDS, $postinfo); 
    }        

    curl_setopt($curlh, CURLOPT_COOKIEJAR, "/curl_cookies/curl_cookies.txt"); 

     curl_setopt($curlh, CURLOPT_COOKIEFILE, "/curl_cookies/curl_cookies.txt"); 
        
    curl_exec($curlh); 
    curl_close($curlh); 
  
    return 1; 
} 

 

This is how it is being used:

 

The flow follows the "Dispatch" method suggested in this article http://shiflett.org/articles/secure-design.

 

All dynamic pages (excluding Gallery) are entered through http://www.hrsms.org/run.php with an option set as a GET parameter, ex. http://www.hrsms.org/run.php?script=resources

 

If a vistor requests a private page ex. http://www.hrsms.org/run.php?script=members, they are redirected to the login page, if not already logged in.  When the form is submitted and the user validated the form posts back to the originally requested page, the script see the user is logged in, and the content is displayed.  Again, in a little more detail:

 

• User navigates to
  http://www.hrsms.org/run.php?script=members
  
• Code detects user is not currently loggin in and redirects to http://www.hrsms.org/run.php?script=login with POST 'requested_page'='members'.  The login script detects the form has not been submitted, and therefore displays a login form
  
• On submit the form posts to http://www.hrsms.org/run.php?script=login with POST variables for username, password, and original requested page.  This time the login script detects that the form is submitted and validates the username and password.  If correct, it redirects to http://www.hrsms.org/run.php?script=members
  
• This time the members script sees that the user is logged in and displays the requested content.
  

 

 

The login form tries to match a token (hidden field of form) to the current session token.  The problem appears to be that the session cookie is not available after redirecting using cURL, so the form creates a new token, which will not match the current session token.  The current session is available when keying in a new web address, clicking a link <a href="...> or posting the form.  It is the cURL redirect that is not passing along the cookie (or whatever the correct term may be).

 

It's the first time I've attempted to use cURL.

Can anyone spot my error above?

 

Thanks!!

[gkh01]

I've tried a number of other things, including moving the cookie file (temporarily) to public_html.  There was no difference.

 

I'm still stuck on this and would appreciate any help I recieve.  Soon I'll have to give up on the automatic redirects and add a couple of "click to continue" links.  I sure would like to avoid that though...