Question

我正在做SEB开放银行的Api集成，而Curl跟随位置，它没有像普通浏览器一样对URL进行编码。

        $url = 'https://api-sandbox.sebgroup.com/mga/sps/oauth/oauth20/authorize?' . 'client_id=XXXXXXXXXXXX&response_type=code&scope=psd2_accounts%20psd2_payments&redirect_uri=https://testcallback.com/test';
        curl_setopt_array($curl, array(
            CURLOPT_HEADER => true,
            CURLOPT_URL => $url,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_MAXREDIRS => 10,
            CURLOPT_TIMEOUT => 30,
            CURLOPT_FOLLOWLOCATION => true,
            CURLOPT_CUSTOMREQUEST => "GET",
            CURLOPT_VERBOSE => true,
            CURLOPT_HTTPHEADER => array(
                "accept: text/html",
            ),
        ));

        $response = curl_exec($curl);
        $err = curl_error($curl);

这是原木中的卷曲细节

< HTTP/1.1 302 Found
< content-language: en-US
< date: Thu, 25 Jul 2019 21:15:49 GMT
< location: https://api-sandbox.sebgroup.com/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=psd2_accounts psd2_payments&redirect_uri=https://testcallback.com/test&state=undefined
< p3p: CP="NON CUR OTPi OUR NOR UNI"
< x-frame-options: SAMEORIGIN
< Strict-Transport-Security: max-age=15552000; includeSubDomains
< Transfer-Encoding: chunked
< 
* Ignoring the response-body
* Connection #0 to host api-sandbox.sebgroup.com left intact
* Issue another request to this URL: 'https://api-sandbox.sebgroup.com/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=psd2_accounts psd2_payments&redirect_uri=https://testcallback.com/test&state=undefined'
* Expire in 30000 ms for 8 (transfer 0x5572d97d6ad0)
* Found bundle for host api-sandbox.sebgroup.com: 0x5572d97744f0 [can pipeline]
* Could pipeline, but not asked to!
* Re-using existing connection! (#0) with host api-sandbox.sebgroup.com
* Connected to api-sandbox.sebgroup.com (129.178.54.70) port 443 (#0)
* Expire in 0 ms for 6 (transfer 0x5572d97d6ad0)
> GET /mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=**psd2_accounts psd2_payments**&redirect_uri=https://testcallback.com/test&state=undefined HTTP/1.1
Host: api-sandbox.sebgroup.com
Cookie: AMWEBJCT!%2Fmga!JSESSIONID=00009xuAYPuCp9GW43jcmC-CafK:f218d509-b31a-4e85-82f3-4026c87d2a41; TS01edf909=0107224bed281ed0132bcd33d1abd742777866cf59ada955adfb4e11b262eec4177bcfece6d5008e34b56a7ab37f409ab22798b97dd781fcdbe67b1d85c3acb10a1c21f2ca; TS01ef558a=0107224bed32bbf99c1c620e086bb40f0577a7d1fcada955adfb4e11b262eec4177bcfece69dd83308b2725dc487ace1c823d15bd6e2e5d0d2968f3683570ed32b96ea5da2; C0WNET=03758b02-5d3a-4321-a19f-1c022988e2f4
accept: text/html

< HTTP/1.1 400 Bad Request
< Cache-Control: no-cache
< Connection: close
< Content-Type: text/html; charset=utf-8
< Pragma: no-cache
< Content-Length: 246
< 
* Closing connection 0

此关注位置包含一个空格betweeb（psd2_accounts psd2_payments）。哪些未转换为％20

/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=**psd2_accounts psd2_payments**&redirect_uri=https://testcallback.com/test&state=undefined

如何对以下位置参数进行编码，以使上述网址自动变为

/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:username_login&client_id=XXXXXXXXXXXX&response_type=code&scope=**psd2_accounts%20psd2_payments**&redirect_uri=https://testcallback.com/test&state=undefined

Answer 1

URL已按定义URL进行了编码。否则，它不是URL。根据定义，HTTP重定向应该重定向到URL，并且它们必须已经被URL编码。否则会违反HTTP规范（Source）。 api-sandbox.sebgroup.com网站未在其重定向中返回真实的URL。也许您应该考虑与他们联系并通知他们这个问题，因为cURL是访问API的一种非常普遍的方式。

如果他们不能及时解决此问题，我不建议仅对Location标头进行url编码，因为他们将来可能会对其进行修复，因此您将对URL进行双重编码，这显然也是错误的。仅当它无效时，您才需要对其进行urlencode。

因此，我建议是删除 CURLOPT_FOLLOWLOCATION选项，以确保它不遵循重定向，并添加一个CURLOPT_HEADERFUNCTION，它将由对收到的每个标头进行curl操作，仅在存在且无效的情况下对Location标头进行urlencode，然后循环执行curl，直到没有Location标头为止。由于网址中的空格违反规范，因此PHP的filter_var()函数将其视为无效。

$url = 'https://example.com';

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

// this function is called by curl for each header received
curl_setopt($ch, CURLOPT_HEADERFUNCTION,
    function($curl, $header) use (&$headers) {
        $len = strlen($header);
        $header = explode(':', $header, 2);
        if (count($header) < 2) {
            // ignore invalid headers
            return $len;
        }

        $name = strtolower(trim($header[0]));

        if ($name == 'location' && !filter_var(trim($header[1]), FILTER_VALIDATE_URL)) {
            $header[1] = urlencode(trim($header[1]));
        }

        $headers[$name][] = trim($header[1]);

        return $len;
    }
);

// Maximum number of redirects
$max_iterations = 10;
$iterations = 0;

do {
    $url = $headers['location'][0] ?? $url;
    $headers = [];
    curl_setopt($ch, CURLOPT_URL, $url);
    $data = curl_exec($ch);
    print_r($headers);

} while (isset($headers['location']) && ++$iterations < $max_iterations);

当Curl在追踪位置时，有什么方法可以进行urlencode /转义？

1 个答案: