PHP CURL error 403

Question

I'm trying to get some data in CURL. For this i need to do it in 2 step :
-get my token code and custom url
-Fetch the data i need

for the first part i did

$url = 'https://url.com/login';

$params = array( "KeyName" => "KeyValue");
$params = json_encode($params);
$ch = curl_init( $url );
curl_setopt( $ch, CURLOPT_POST, 1);
curl_setopt( $ch, CURLOPT_POSTFIELDS, $params);
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_ENCODING, "");
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);

//recovery of token and URL
$response = curl_exec($ch);
$value = json_decode($response);
$value_token = $value->data->token;
$url = $value->data->url;

i get both values without a problem but when i try the next step i get an error 403. here is my code :

$params = array( "X-Session-Token" => "$value_token");
$params = json_encode($params);
$url = $url ."/api";

$ch = curl_init( $url );
curl_setopt( $ch, CURLOPT_POST, 1);
curl_setopt( $ch, CURLOPT_POSTFIELDS, $params);
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch , CURLINFO_HTTP_CODE);
echo $httpCode ."<- code http<br>";
if ($response === false) $response = curl_error($ch);
    echo stripslashes($response) ."<br>"; //return 1
curl_close($ch);
$val = json_decode($response);

I've already done it succesfully in command promt. here is the command prompt for the second request :

curl "https://custom-url.com/api" \
-­H "Accept: application/json, text/*;q=0.2" \
­-H "Accept-­Charset: utf­8" \
­-H "Accept-­Encoding: gzip, deflate" \
­-H "Access-­Control­-Request-­Headers: x-­session-­token" \
­-H "X­-Session-­Token: MyToken" \
--­­compressed

Update
here is the request with the updated header :

$ch = curl_init( $url );
curl_setopt( $ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_HTTPHEADER, array('X-Session-Token' => $value_token,'Access-Control-Request-Headers' => 'X-Session-Token', 'Accept' => 'application/json, text/*;q=0.2', 'Accept-Encoding' => 'gzip, deflate', 'Access-Control-Allow-Origin' =>'*'));
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_HEADER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLINFO_HEADER_OUT, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLINFO_HEADER_OUT, true);

curl_exec($ch);

$info = curl_getinfo($ch);
print_r("<br>print : ". $info['request_header']);

print_r return : POST /api HTTP/1.1 Host: website.com Accept: / Content-Type: application/x-www-form-urlencoded Expect: 100-continue

Answer 1

Have you tried adding a request header? Try adding curl_setopt($ch, CURLOPT_HEADER, true);and see if that helps.

Answer 2

If we are talking of session tokens here, every API would have a different standard for accepting tokens. Some are encoded as Bearer tokens, some need to be in the URL, and some need a POST variable.

This sounds like a case where it's a special header:

curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'X-Session-Token' => $value_token
));

or, if you want to exactly match the commandline CURL request:

curl_setopt($ch, CURLOPT_HTTPHEADER, array(
    'X-Session-Token' => $value_token,
    'Access-­Control­-Request-­Headers' => 'X-Session-Token'
));