关于模拟登陆的问题！__RequestVerificationToken值每次都会变！

[hmw145]

php代码如下

//参数1：访问的URL，参数2：post数据(不填则为GET)，参数3：提交的$cookies,参数4：是否返回$cookies
 function curl_request($url,$post='',$cookie='', $returnCookie=0){
        $curl = curl_init();
		curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($curl, CURLOPT_URL, $url);
        curl_setopt($curl, CURLOPT_USERAGENT, 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)');
        curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
        curl_setopt($curl, CURLOPT_AUTOREFERER, 1);
        curl_setopt($curl, CURLOPT_REFERER, "http://XXX 

");
        if($post) {
            curl_setopt($curl, CURLOPT_POST, 1);
            curl_setopt($curl, CURLOPT_POSTFIELDS, http_build_query($post));
        }
        if($cookie) {
            curl_setopt($curl, CURLOPT_COOKIE, $cookie);
        }
        curl_setopt($curl, CURLOPT_HEADER, $returnCookie);
        curl_setopt($curl, CURLOPT_TIMEOUT, 10);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
        $data = curl_exec($curl);
        if (curl_errno($curl)) {
            return curl_error($curl);
        }
        curl_close($curl);
        if($returnCookie){
            list($header, $body) = explode("\r\n\r\n", $data, 2);
            preg_match_all("/Set\-Cookie:([^;]*);/", $header, $matches);
            $info['cookie']  = substr($matches[1][0], 1);
            $info['content'] = $body;
            return $info;
        }else{
            return $data;
        }
}

//
$url = 'https://login.nipic.com/ 

';
     $post['username'] = "";
     $post['userpass'] = "";
	 $post['imgCode'] = "";
     $result = curl_request($url);

模拟登陆post 数据徐要填写__RequestVerificationToken:这个值，能获取到，但是每刷新一次都会变！
比如 $result = curl_request($url);通过这个方法获取到了__RequestVerificationToken这个值，准备填写好账号密码又通过这个方法$result = curl_request($url，$username,$pwd);提交的时候，__RequestVerificationToken这个值又刷新变了新的了。。

[xuzuning]

print_r(get_headers('https://login.nipic.com'));

Array
(
    [0] => HTTP/1.1 200 OK
    [1] => Cache-Control: private
    [2] => Content-Type: text/html; charset=utf-8
    [3] => Server: Microsoft-IIS/7.5
    [4] => X-AspNetMvc-Version: 4.0
    [5] => Set-Cookie: __RequestVerificationToken=mUSIeMSWtbFAby3zyqK3FPtHyfiUKKfcaErCf4QgP0y-xM6cC_1XcojMKptZPPaRY3eDgsLwOnK8JJCqTDZXpMHSCGCqeZ1HKr0dudWYRu8SRImP5tFzA-2Cky81; path=/; HttpOnly
    [6] => X-Powered-By: ASP.NET
    [7] => Date: Mon, 04 Sep 2017 23:46:41 GMT
    [8] => Connection: close
    [9] => Content-Length: 14357
)

__RequestVerificationToken 只通过 cookie 传递的，并没有看到你接收 cookie 的代码

[xuzuning]

与 sessionid 不同的是 token 是实时发布的 session 在收到 sessionid 后就保持 sessionid 不变 而 token 每次会话都可能变

[xuzuning]

CURLOPT_COOKIEJAR 是将收到的 cookie 保存到文件 CURLOPT_COOKIEFILE 是将保存在文件中的 cookie 发送出去