Okay, so here is my (maybe quite challenging) problem:
I am trying to login on 9gag.com/login with PHP and cURL, but it is not working. There is no error or anything, even the response looks fine.
The login form is protected with a CSRF token, so the script connects for the first time to get the cookies (session, ts1 etc.) and the associated CSRF token.
After that the script posts the obtained cookies, the CSRF token and also the username/password combination to the server.
You might notice that a few more cookies like "_gat" or "__gads" are posted, too, but their values either do not change, are self-explaining (for example "countryCode") or are only important for Google ad tracking and statistical purposes.
These two requests are exactly like a browser (in my case Safari) would submit them (I used Live HTTP Headers), so the API should not see any difference at all.
Here is my php snippet:
$login_email = 'some_email@email.com';
$login_pass = 'some_password';
function get_string_between($string, $start, $end) {
$string = ' ' . $string;
$ini = strpos($string, $start);
if ($ini == 0) return '';
$ini += strlen($start);
$len = strpos($string, $end, $ini) - $ini;
return substr($string, $ini, $len);
}
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'https://9gag.com/login');
curl_setopt($ch, CURLOPT_POST, FALSE);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept-Charset: utf-8',
'Accept-Language: en-us,en;q=0.7,bn-bd;q=0.3',
'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8'));
curl_setopt($ch, CURLOPT_COOKIEJAR, getcwd () . '/cookies_9gag.txt' );
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1 Safari/601.5.17");
$gag_login_page = curl_exec($ch) or die(curl_error($ch));
$pos_csrftoken = strpos($gag_login_page, 'name="csrftoken"');
$part_csrf = substr($gag_login_page, $pos_csrftoken + 9, 100);
$gag_csrf = get_string_between($part_csrf, 'value="', '"');
preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $gag_login_page, $matches);
$cookies = array();
foreach($matches[1] as $item) {
parse_str($item, $cookie);
$cookies = array_merge($cookies, $cookie);
}
$phpsessid = $cookies['PHPSESSID'];
$ts1 = $cookies['ts1'];
$ri = $cookies['____ri'];
$session = $cookies['session'];
//echo 'Cookie: _gat=1;____ri='.$ri.'; ts1='.$ts1.'; sign_up_referer=https%3A%2F%2F9gag.com%2Flogin; countryCode=00; cacheableGrace=1; __gads=ID=d94815096752d058:T=1462990222:S=ALNI_Ma8SdWnOioJeYSCcIdj7p1LdHtgpA; PHPSESSID='.$phpsessid.'; session='.urlencode($session).'; gag_tz=2; _ga=GA1.2.1699141998.1462990222; _pk_id.7.f7ab=d2deed23abfae124.1462990220.1.1462990329.1462990220.; _pk_ses.7.f7ab=*';
curl_setopt($ch, CURLOPT_URL, 'https://9gag.com/login');
curl_setopt($ch, CURLOPT_POSTFIELDS,'csrftoken='.urlencode($gag_csrf).'&next='.'&location=1'.'&username='.urlencode($login_email).'&password='.urlencode($login_pass));
curl_setopt($ch, CURLOPT_POST, TRUE);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('Accept-Charset: utf-8',
'Connection: keep-alive',
'Accept-Language: en-us,en;q=0.7,bn-bd;q=0.3',
'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Cookie: _gat=1; ____ri='.$ri.'; ts1='.$ts1.'; sign_up_referer=https%3A%2F%2F9gag.com%2Flogin; countryCode=00; cacheableGrace=1; __gads=ID=d94815096752d058:T=1462990222:S=ALNI_Ma8SdWnOioJeYSCcIdj7p1LdHtgpA; PHPSESSID='.$phpsessid.'; session='.urlencode($session).'; gag_tz=2; _ga=GA1.2.1699141998.1462990222; _pk_id.7.f7ab=d2deed23abfae124.1462990220.1.1462990329.1462990220.; _pk_ses.7.f7ab=*'
));
curl_setopt($ch, CURLOPT_COOKIEFILE, getcwd () . '/cookies_9gag.txt' );
curl_setopt($ch, CURLOPT_COOKIEJAR, getcwd () . '/cookies_9gag.txt' );
curl_setopt($ch, CURLOPT_RETURNTRANSFER, TRUE);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/601.5.17 (KHTML, like Gecko) Version/9.1 Safari/601.5.17");
$gag_logged_in_page = curl_exec($ch) or die(curl_error($ch));
$pos = strpos(gag_logged_in_page, 'some_username');
if ($pos === false) {
echo 'Not logged in.';
}
curl_close($ch);
Thank you for reading and your help! Have a nice day!
PS: I know that the code to obtain the cookies and the CSRF token from the response might be a bit unusual and there are better ways to do it, but it is working (checked already).
PS2: I also know that there is already a JSON API for 9gag, called Infinigag, but it has not the functionality that I need, so I cannot use it. I already contacted the author but he is not responding since weeks, so there is no chance for me to ask him how he managed to solve this problem.