PHP cURL with authentication

AfterEffect · 10 Jun 2012 at 23:54

Hey all,

I'm trying to scrape the activity feed from the Barclay's Cycle Hire website but have come to a dead end because the page with the login form seems to set a hidden POST variable, so I'll need to retrieve and cache that in cURL, but not sure how

The login form is here:
https://web.barclayscyclehire.tfl.gov.uk/

It seems to submit three POST variables:

login[Username]
login[Password]
login[_csrf_token]

The csrf_token one seems completely random each time you load the page... so not sure how to do this in cURL

edit:
Basic form code:

Code:

<form action="/" method="post">
       <fieldset>
                        <label for="login_Email">Email address</label>                        <input autocomplete="off" size="40" maxlength="254" type="text" name="login[Email]" id="login_Email" />
                        <label for="login_Password">Password</label>                        <input autocomplete="off" size="20" maxlength="16" type="password" name="login[Password]" id="login_Password" />
                        <!-- SUBMIT BUTTON -->
                        <input type="submit" value="Sign in" class="button-default-1" />
            <!-- TOKEN -->
                        <input type="hidden" name="login[_csrf_token]" value="a213399200aa6fb6d90e3de70835d23d" id="login__csrf_token" />       </fieldset>
	</form>

edit2!: I tried using pret_match to grab the value but I think it gets a different value when cURL connects to the site

AfterEffect · 13 Jun 2012 at 19:53

Hmm, so it's pretty much impossible?

If you use a wget to grab the data then the next wget to post the data creates a new csrf token :/

AfterEffect · 30 Aug 2012 at 13:01

Really sorry to bump an old thread, but sort of gave up based on the above advice, however I've just seen somebody has released an android app which does what I'm trying to do... so there must be a way!!

I've played around with cURL but haven't used it for any advanced stuff before so not sure what to do about the csrf token

Any help would be HUGELY appreciated

AfterEffect · 30 Aug 2012 at 13:42

visibleman said:
You sure there isn't an API of sorts?

Edit - Looks like there are a handful of API's available - http://www.tfl.gov.uk/businessandpartners/syndication/default.aspx

There are for bike availability but not for specific account history. You can only get that by logging into the Cycle part of the TfL site.