Is this possible? Login to remote site using cURL, then pass credentials to browser.

[JDS]

So, I'd like to create the following scenario:

1) Use cURL library within PHP (cURL + "Cookie Jar", et.al) to create a
virtual browser session that "logs in" to a remote site. (For example:

here:
http://curl.haxx.se/libcurl/php/examples/cookiejar.html

and here:
http://curl.haxx.se/libcurl/php/exam...bay_login.html
2) Save the login credentials -- cookies, session vars, whatever -- and
pass that to the web browser so that now the web browser is logged in.

Is that possible?

How can one take the values in the cookie jar and create the same cookies
in the browser session?

etc.

Thanks!

--
JDS

[shimmyshack]

On May 15, 6:01 pm, JDS <jeff...@invali d.addresswrote:

So, I'd like to create the following scenario:

1) Use cURL library within PHP (cURL + "Cookie Jar", et.al) to create a
virtual browser session that "logs in" to a remote site. (For example:

here:http://curl.haxx.se/libcurl/php/examples/cookiejar.html

and here:http://curl.haxx.se/libcurl/php/exam...bay_login.html

2) Save the login credentials -- cookies, session vars, whatever -- and
pass that to the web browser so that now the web browser is logged in.

Is that possible?

How can one take the values in the cookie jar and create the same cookies
in the browser session?

etc.

Thanks!

--
JDS

in the traditional model of client<->server1.com<->server2.com the
credentials (if stored as cookies) will only be valid for domain
server1.com, so you cannot hand off the credentials to the client

however if you use some client side scripting to map only part of
server2.com's domain space to server1.com the rest making a straight
through connection to server2.com then it is possible under certain
circumstances. (those being that server2.com uses the session id as an
authentication token)

For instance: foxy proxy within firefox, which proxies a request for a
URL matching server2.com/login.php via a machine on which server1.com
runs AND vhost server2.com, and which has a DNS/host entry for
server2.com pointing to itself. This machine makes a cURL requests
logging on to server2.com using its real IP address. It returns the
credentials to the client back though the proxy, meanwhile all the
images and so forth have been downloaded from the server2.com to the
client unproxied. The cookie would then appear to have been sent by a
header from the correct host and now you can continue using
server2.com from the client and the client will send the correct
cookie.

I have tested this and use it routinely to overcome same domain
restrictions in order to inject code into the webpages I view to make
the user experience better for me, removing adverts or simply
returning a larger dataset, etc... for fun rather than for profit.

There are of course situations in which this technique would not work,
but give it a go.

[JDS]

On Tue, 15 May 2007 10:16:35 -0700, shimmyshack wrote:

>
in the traditional model of client<->server1.com<->server2.com the
credentials (if stored as cookies) will only be valid for domain
server1.com, so you cannot hand off the credentials to the client

Okay, so, I think I have my original answer: "NO"

That's okay. I found an acceptable workaround. Note: This workaround may
not be acceptable to everyone as it uses JavaScript and depends on client
side behavior!

Solution:

1) Create PHP script that gathers creds and maps them to the proper
username/password.

2) Embed an HTML form that mimics the POST form I need to circumvent

3) Use the onload() and submit() events to submit creds via POST method

This works! Yay!
--
JDS | je*****@example .invalid
| http://www.newtnotes.com
DJMBS | http://newtnotes.com/doctor-jeff-master-brainsurgeon/

[shimmyshack]

On May 21, 10:43 pm, JDS <jeff...@exampl e.invalidwrote:

On Tue, 15 May 2007 10:16:35 -0700, shimmyshack wrote:

in the traditional model of client<->server1.com<->server2.com the
credentials (if stored as cookies) will only be valid for domain
server1.com, so you cannot hand off the credentials to the client

Okay, so, I think I have my original answer: "NO"

That's okay. I found an acceptable workaround. Note: This workaround may
not be acceptable to everyone as it uses JavaScript and depends on client
side behavior!

Solution:

1) Create PHP script that gathers creds and maps them to the proper
username/password.

2) Embed an HTML form that mimics the POST form I need to circumvent

3) Use the onload() and submit() events to submit creds via POST method

This works! Yay!
--
JDS | jeff...@example .invalid
|http://www.newtnotes.com
DJMBS |http://newtnotes.com/doctor-jeff-master-brainsurgeon/

now this /is/ possible as you describe, however it isnt a virtual
session, but rather, a real one, directly between the browser and the
site.
You can of course write a proxy routine, that posts the data using
cURL, and hands back not the session id, but the protected content,
and integrate that into the pages. This would work well where you
control both the site you /were/ on and the site that needs to be
"logged in to" you can mix and match data scross domains this way
although it is not recommended as it's basically XSS and is bound to
be gradually harder to pull off under tighter models in the furture.