PHP remote login with cURL, need advice

Question

I'll try to explain the issue, I don't know if it is doable...

If you login here (1st link):

https://profile.ea.com/

And then go here (2nd link):

https://accounts.ea.com/connect/auth?client_id=sparta-companion-web&response_type=code&prompt=none&redirect_uri=nucleus:rest

You will find a code like this only if you are logged (token):

{"code":"QUORAL0aEYq2RjJGJwFEIddI99wM_FaZ_FgktceQ"}

That token is what I need to make some (not documented) API calls work from my web app (cURL with PHP). I'm trying to emulate what I do when I execute a login but it seems to fail every time and I can't understand why...

This is my 1st call for the 1st link:

<?php

$username = urlencode('myaccount@mail.test');
$password = 'Mysecretpassword';
$event = 'submit';
$loginUrl = 'https://profile.ea.com/';

//init curl
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $loginUrl);
curl_setopt($ch, CURLOPT_POST, 1);
//curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, 'email='.$username.'&password='.$password.'&_eventId='.$event);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookie.txt');
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookie.txt');
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$firstlogin = curl_exec($ch);
//var_dump($firstlogin);

//login done?

Then the token part:

//get the token
curl_setopt($ch, CURLOPT_URL, 'https://accounts.ea.com/connect/auth?client_id=sparta-companion-web&response_type=code&prompt=none&redirect_uri=nucleus:rest');

//execute the request
$token = curl_exec($ch);

var_dump($token);die;

The main issue is the 1st part:

The profile.ea link seems to do a redirect to a unique url, maybe the CURLOPT_FOLLOWLOCATION is not enough?
The data needed to login is an array with 'email', 'password' and '_eventId' but I can't find any other required field.

What I'm doing wrong? Why the login is not working? How can I debug what is not working?

*but I can't find any other required field.* look at the console, there is many many more plus query string plus many headers.. good luck, im not into helping people curl into sites which dont allow it. — Lawrence Cherone, Apr 12 '18 at 19:47
If EA does not have any API documentation for interacting with that service then you are probably violating their terms of use and could easily get sued... — MonkeyZeus, Apr 12 '18 at 19:50

score 0 · Answer 1 · answered Apr 12 '18 at 20:06

Probably the issue is that when you hit first url with code $firstlogin = curl_exec($ch);. It essentially does not mean that you got logged in for every request now. The next url hit needs to know, who you are before sending you the data, and they are possibly using cookies for this identification. Try simulating it in a browser. Probably, with the first URL request, there are some cookies returned after logging in, which are then forwarded with the next request.

You need to replicate cookies with your curl too. Try to extract any cookies being set with login cURL with the code at this link.

Then forward the cookies with your cURL request using curl_setopt($ch, CURLOPT_HTTPHEADER, array("Cookie: test=cookie"));

If above doesn't work, try replicating the same scenerio at browser and find out all the cookies in browser. Then replicate cookies already set and the ones being set by the login cURL request. This should probably work.

score 0 · Answer 2 · answered Apr 12 '18 at 21:29

you're doing lots of things wrong,

you don't urlencode $username, but you need to. you don't urlencode $password, but you need to. you don't urlencode $event, but you need to. you don't use, nor try to fetch, the csrf token (called execution) prior to sending the login request, that won't work. you try to login without a pre-existing cookie session, that won't work, the cookie session and the csrf token are tied together, if 1 of them are missing/incorrect, your login won't be successful, and your code fetches neither of them. you're also missing a lot of login post parameters, including phoneNumber, passwordForPhone, _rememberMe, and several others, add them all.

PHP remote login with cURL, need advice

2 Answers2