有没有办法在 Curl 跟踪位置时进行 urlencode/escape ?

Question

>我正在对SEB开放银行进行API集成，而Curl跟随位置，它不像普通浏览器那样对URL进行编码。

$url = 'https://api-sandbox.sebgroup.com/mga/sps/oauth/oauth20/authorize?' . 'client_id=XXXXXXXXXXXX&response_type=code&scope=psd2_accounts%20psd2_payments&redirect_uri=https://testcallback.com/test';
curl_setopt_array($curl, array(
CURLOPT_HEADER => true,
CURLOPT_URL => $url,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_VERBOSE => true,
CURLOPT_HTTPHEADER => array(
"accept: text/html",
),
));
$response = curl_exec($curl);
$err = curl_error($curl);

这是日志中的卷曲详细

< HTTP/1.1 302 Found
< content-language: en-US
< date: Thu, 25 Jul 2019 21:15:49 GMT
< location: https://api-sandbox.sebgroup.com/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=psd2_accounts psd2_payments&redirect_uri=https://testcallback.com/test&state=undefined
< p3p: CP="NON CUR OTPi OUR NOR UNI"
< x-frame-options: SAMEORIGIN
< Strict-Transport-Security: max-age=15552000; includeSubDomains
< Transfer-Encoding: chunked
< 
* Ignoring the response-body
* Connection #0 to host api-sandbox.sebgroup.com left intact
* Issue another request to this URL: 'https://api-sandbox.sebgroup.com/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=psd2_accounts psd2_payments&redirect_uri=https://testcallback.com/test&state=undefined'
* Expire in 30000 ms for 8 (transfer 0x5572d97d6ad0)
* Found bundle for host api-sandbox.sebgroup.com: 0x5572d97744f0 [can pipeline]
* Could pipeline, but not asked to!
* Re-using existing connection! (#0) with host api-sandbox.sebgroup.com
* Connected to api-sandbox.sebgroup.com (129.178.54.70) port 443 (#0)
* Expire in 0 ms for 6 (transfer 0x5572d97d6ad0)
> GET /mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=**psd2_accounts psd2_payments**&redirect_uri=https://testcallback.com/test&state=undefined HTTP/1.1
Host: api-sandbox.sebgroup.com
Cookie: AMWEBJCT!%2Fmga!JSESSIONID=00009xuAYPuCp9GW43jcmC-CafK:f218d509-b31a-4e85-82f3-4026c87d2a41; TS01edf909=0107224bed281ed0132bcd33d1abd742777866cf59ada955adfb4e11b262eec4177bcfece6d5008e34b56a7ab37f409ab22798b97dd781fcdbe67b1d85c3acb10a1c21f2ca; TS01ef558a=0107224bed32bbf99c1c620e086bb40f0577a7d1fcada955adfb4e11b262eec4177bcfece69dd83308b2725dc487ace1c823d15bd6e2e5d0d2968f3683570ed32b96ea5da2; C0WNET=03758b02-5d3a-4321-a19f-1c022988e2f4
accept: text/html
< HTTP/1.1 400 Bad Request
< Cache-Control: no-cache
< Connection: close
< Content-Type: text/html; charset=utf-8
< Pragma: no-cache
< Content-Length: 246
< 
* Closing connection 0

此关注位置包含介于 (psd2_accounts psd2_payments) 之间的空格。未转换为 %20

/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=**psd2_accounts psd2_payments**&redirect_uri=https://testcallback.com/test&state=undefined

如何对以下位置参数进行编码，以便上述 url 自动变为

/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=**psd2_accounts%20psd2_payments**&redirect_uri=https://testcallback.com/test&state=undefined

Answer 1

URL已按定义 URL 编码。否则，它不是 URL。根据定义，HTTP 重定向应该重定向到 URL，并且它们必须已经进行了 URL 编码。不这样做违反了HTTP规范(来源)。api-sandbox.sebgroup.com 网站在其重定向中没有返回真实的URL。也许您应该考虑与他们联系并通知他们此问题，因为 cURL 是访问 API 的一种非常常见的方式。

如果他们不能及时解决这个问题，我不建议只对Location标头进行 url 编码，因为他们将来可能会修复它，然后您将对 URL 进行双重编码，这显然也是错误的。仅当它无效时，您才需要对其进行编码。

因此，我的建议是删除CURLOPT_FOLLOWLOCATION选项以确保它不遵循重定向并添加一个CURLOPT_HEADERFUNCTION，它将由 curl 为收到的每个标头调用，仅当存在且无效时，才对Location标头进行编码，然后在循环中执行 curl，直到没有Location标头。由于URL中的空格违反了规范，PHP的filter_var()函数正确地认为它是无效的。

$url = 'https://example.com';
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
// this function is called by curl for each header received
curl_setopt($ch, CURLOPT_HEADERFUNCTION,
function($curl, $header) use (&$headers) {
$len = strlen($header);
$header = explode(':', $header, 2);
if (count($header) < 2) {
// ignore invalid headers
return $len;
}
$name = strtolower(trim($header[0]));
if ($name == 'location' && !filter_var(trim($header[1]), FILTER_VALIDATE_URL)) {
$header[1] = urlencode(trim($header[1]));
}
$headers[$name][] = trim($header[1]);
return $len;
}
);
// Maximum number of redirects
$max_iterations = 10;
$iterations = 0;
do {
$url = $headers['location'][0] ?? $url;
$headers = [];
curl_setopt($ch, CURLOPT_URL, $url);
$data = curl_exec($ch);
print_r($headers);
} while (isset($headers['location']) && ++$iterations < $max_iterations);