tags:

views:

33

answers:

3

Hey all,

I'm trying to set a cookie for my phpBB forums from a MediaWiki login page. Using the hook after a login to the wiki is successful, I want to run a php script that sets the cookie.

The script works when I run it independently or when I use GET , but for security reasons I want to POST to the script. For this I figured curl would be the best option.

Unfortunately, even the basic script like this:

curl_setopt($ch, CURLOPT_URL, "http://www.mydomain.com/ForumLogin.php");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_exec($ch);
curl_close($ch);

Gives me a 403 Forbidden error. There's no rules in robots.txt that should interfere. What else could I try to get the script to work, or are there any other ways I could run the script from within MediaWiki?

A: 

Please check below forum.

http://bytes.com/topic/php/answers/160081-curl-gives-403-forbidden

Hope this helps.

Yogesh
The options here I'd already tried. Doesn't solve it, unfortunately.
Litso
+1  A: 

Or http://www.checkupdown.com/status/E403.html

Alex
Ah, this got me a little furter: when using a relative path (in stead of the full url) to the file I don't get the error anymore. The script still doesn't work, but at least access is allowed.Any idea how I can debug this now?
Litso
Hmm, apparently it now directs to http://ForumLogin.php, this doesn't work either..
Litso
+1  A: 

I'd suspect the justification for this is explicitly to stop automated behaviour - an anti-bot or general security measure. You may wish to look at the source code of the destination site and check for any such measures - a quick search of the code for '403' might offer some insight. It may even be the case that POST requests are not legitimate in that context - and thus prevented for security reasons.

I'm not sure what you mean by 'for security reasons' by the way. POST isn't more secure than GET. They're both open to just as much scrutiny.

Rushyo
The destination is a hand-scripted page of about 20 rules. I didn't send a POST yet, even the basic script in the question is denied by the receiving script. Also, because I have to send the username and password from one script to the other I figured I shouldn't do that in the query string of an url. Am I wrong?
Litso
Have you checked the server configuration? How about other pages? Regarding the other issue: POST is no more secure. You need SSL to keep the information secret in transit.
Rushyo
Ok, I realize when using curl GET and POST don't make a difference, but I chose for curl because I didn't want a GET in the url. Which is less safe, because it saves your username and pass as a query string in the browser history. Anyway, it's not the issue. What should I check in the server configuration?
Litso
That depends on the server. Anything related to access privileges really... I'd also recommended testing cURL is working as intended by making a similar req. to another document (if you haven't already). You need to rule out as many variables/technologies as possible to narrow down the options (there's a million reasons you might get a 403, it's kinda like saying you got a BSOD for accessing protected memory). ...and no, it's no less safe. Trust me. Making it obscure doesn't make it any more secure. Staple rule of security.
Rushyo
Bah, this is gonna suck :P Thanks for the advice, I'll probably accept your answer somewhere today when I give up.
Litso
well, even if I strip everything from the two scripts and try to curl one page from the other I get the error :/
Litso
What about if you try to cURL another server? Do you still get a 403? If not, I'd check your server configuration first and foremost for anything related to access privileges.
Rushyo
Haven't solved it, but you helped me well. Thanks.
Litso