How to grab cookies from remote URL and send them back to the browser

How to Grab Cookies from a Remote URL and Send Them Back to the Browser

Learn how to programmatically fetch cookies from a remote server and seamlessly transfer them to a user's browser, enabling session continuity and advanced web interactions.

Managing cookies is a fundamental aspect of web development, crucial for maintaining user sessions, personalization, and tracking. This article delves into the process of programmatically retrieving cookies from a remote URL and then sending those cookies back to the user's browser. This technique is particularly useful in scenarios like proxying requests, implementing single sign-on (SSO) solutions, or integrating with third-party APIs that rely heavily on session management. We'll explore the concepts using PHP for server-side operations and discuss how this applies to various client environments, including Android.

Understanding the Cookie Flow

Before diving into implementation, it's essential to understand the typical cookie exchange process. When a browser makes a request to a server, the server can respond with a Set-Cookie header, instructing the browser to store a cookie. Subsequent requests from that browser to the same domain will include the stored cookie in the Cookie header. Our goal is to intercept the Set-Cookie header from a remote server, extract the cookie data, and then issue our own Set-Cookie header to the client's browser.

sequenceDiagram
    participant Browser
    participant YourServer as Your Server (PHP)
    participant RemoteServer as Remote Server

    Browser->>YourServer: Initial Request (e.g., /proxy?url=remote.com)
    YourServer->>RemoteServer: Request to Remote URL
    RemoteServer-->>YourServer: Response + Set-Cookie Header
    YourServer->>YourServer: Extract Cookie(s) from Response
    YourServer-->>Browser: Response + Set-Cookie Header(s)
    Browser->>Browser: Store Cookie(s)
    Browser->>YourServer: Subsequent Request (includes cookie from YourServer)
    YourServer->>RemoteServer: Subsequent Request (includes cookie from RemoteServer)
    RemoteServer-->>YourServer: Response
    YourServer-->>Browser: Response

Sequence diagram illustrating the cookie proxying process.

Grabbing Cookies from a Remote URL (PHP)

PHP's cURL library is the go-to tool for making HTTP requests and handling responses, including headers. To grab cookies, we need to configure cURL to capture the response headers. The CURLOPT_HEADER option allows us to include the header in the output, and CURLOPT_RETURNTRANSFER ensures the output is returned as a string rather than directly printed. We then parse this string to extract the Set-Cookie headers.

<?php

function getRemoteCookies(string $url): array
{
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_HEADER, 1); // Include header in output
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); // Return output as string
    curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true); // Follow redirects

    $response = curl_exec($ch);
    $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $header = substr($response, 0, $header_size);
    $body = substr($response, $header_size);
    curl_close($ch);

    $cookies = [];
    preg_match_all('/^Set-Cookie:\s*([^;]*)/mi', $header, $matches);
    foreach ($matches[1] as $cookie) {
        $cookies[] = trim($cookie);
    }

    return [
        'headers' => $header,
        'body' => $body,
        'cookies' => $cookies
    ];
}

// Example usage:
$remoteUrl = 'https://example.com/login'; // Replace with your target URL
$result = getRemoteCookies($remoteUrl);

echo "<h2>Remote Server Response Headers:</h2>";
echo "<pre>" . htmlspecialchars($result['headers']) . "</pre>";

echo "<h2>Extracted Cookies:</h2>";
foreach ($result['cookies'] as $cookie) {
    echo "<p>" . htmlspecialchars($cookie) . "</p>";
}

// You would typically process the body as well
// echo "<h2>Remote Server Body:</h2>";
// echo "<pre>" . htmlspecialchars($result['body']) . "</pre>";

?>

PHP function to fetch a remote URL and extract Set-Cookie headers.

Sending Cookies Back to the Browser (PHP)

Once you've extracted the Set-Cookie headers from the remote server's response, the next step is to forward them to the client's browser. This is done by using PHP's header() function. For each Set-Cookie header you captured, you'll issue a corresponding Set-Cookie header to the client. This effectively makes the client's browser store the cookies as if they came directly from your server.

<?php

// Assuming $result['cookies'] contains the extracted cookies from getRemoteCookies()
$remoteUrl = 'https://example.com/login'; // Replace with your target URL
$result = getRemoteCookies($remoteUrl);

if (!empty($result['cookies'])) {
    foreach ($result['cookies'] as $cookieString) {
        // Re-issue the Set-Cookie header to the client's browser
        // Note: This assumes the cookie domain is compatible or you're modifying it.
        // For direct proxying, sending the original string is often sufficient.
        header("Set-Cookie: {$cookieString}", false); // 'false' prevents overwriting previous headers
    }
    echo "<p>Cookies successfully sent to your browser.</p>";
} else {
    echo "<p>No cookies found to send.</p>";
}

// Optionally, you might want to display the remote content as well
// echo $result['body'];

?>

PHP code to re-issue Set-Cookie headers to the client's browser.

Considerations for Android and Other Clients

While the server-side PHP handles the initial cookie grabbing and re-issuing, the client-side (e.g., an Android app) needs to be aware of how to handle these cookies. If your Android app is making requests to your PHP proxy server, the HTTP client library (like OkHttp or HttpURLConnection) will automatically handle Set-Cookie headers received from your PHP server, storing them in its cookie jar and sending them back on subsequent requests.

If your Android app directly interacts with the remote server after your PHP script has set the cookies, it's crucial that the domain of the re-issued cookies matches the domain the Android app is trying to access, or that the Android app is configured to handle cross-domain cookies if applicable. Often, the PHP script acts as a full proxy, handling all communication with the remote server, and the Android app only communicates with the PHP proxy.

1. Set up a PHP script as a proxy endpoint

Create a PHP file (e.g., proxy.php) that will receive requests from your client and forward them to the remote URL.

2. Implement cURL to fetch remote content and headers

Use the getRemoteCookies function (or similar logic) within your PHP script to make a request to the target remote URL, capturing all response headers, especially Set-Cookie.

3. Extract and re-issue Set-Cookie headers

Parse the captured headers to find all Set-Cookie directives. For each one, use header("Set-Cookie: ...") to send it back to the client's browser or app.

4. Forward the remote server's body content

After handling cookies, send the actual body content received from the remote server back to your client. This completes the proxying action.

5. Client-side (e.g., Android) interaction

Configure your client application to make requests to your PHP proxy endpoint. The client's HTTP library should automatically handle the Set-Cookie headers issued by your PHP script, storing them and sending them back on subsequent requests to your proxy.