0

I'm doing an HTTP POST using cURL in a php file to query the status of a shipment with a carrier API. The request looks like this:

$ch = curl_init();
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_VERBOSE, 1);
curl_setopt($ch, CURLOPT_FRESH_CONNECT, 1);

curl_setopt ($ch, CURLOPT_HTTPHEADER, array (
    'Content-Type: '. 'application/x-www-form-urlencoded',
     'Accept: '. 'text/html'
 ));
curl_setopt($ch, CURLOPT_POSTFIELDS, 'User=peter_smith&Password=abc123&Con='.$con);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_URL, $url); 


$result = curl_exec ($ch); 
$error = curl_error ($ch);
$info = curl_getinfo($ch);

curl_close($ch);

This returns some html for the shipment including a button to view the proof of delivery image showing the person's signature. This is included in the response HTML in a table row like this:

    <tr class="r4" height="26">
    <td colspan="4" align="right" style="padding-right:4px;"><input class="b3" id="viewpod" style="width:130px;" type=button value='View POD Image' onclick="location='https://tntexpress.com.au/cct/SigImg.asp?con=ABC1234&bPODImage=True&bPDSImage=True&bPODSig=True&conID=9632587410&CITCon=True&bDPC=&bATL=&status=IMG&inhouse=true'"></td>                 
</tr>

There's a button to click to view the POD that uses an onclick to go to the url location, however for the url to work you need to include the cookie from the response header that is returned from the original POST request. If I do this in Postman I can see these here:

enter image description here

I'm stumped at this point how I can grab these cookies that are returned from the first request and then set these when the user clicks on the View POD Image in the html that is returned?

user982124
  • 4,248
  • 13
  • 58
  • 130
  • **however for the url to work you need to include the cookie from the response header that is returned from the original POST request** - are you attempting a cross-site request? short answer you cant, its even harder with [`httponly` flag](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie) in place in which you cant use js to touch that cookie. – Bagus Tesa Apr 05 '22 at 10:55

0 Answers0