PHP调用Roblox auth API未返回X-CSRF-TOKEN header问题排查

我正在开发与Roblox API交互的群组等级更新系统，需通过.ROBLOSECURITY Cookie和X-CSRF-TOKEN完成授权。Python版本代码调用auth.roblox.com接口可正常获取X-CSRF-TOKEN响应头，但转写为PHP代码后，该接口未返回此Header。

Python 代码（可正常获取Token） #

import requests
cookie = "_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|..."
session = requests.Session()
session.cookies[".ROBLOSECURITY"] = cookie
req = session.post(
    url="https://auth.roblox.com/"
)
if "X-CSRF-Token" in req.headers:
    session.headers["X-CSRF-Token"] = req.headers["X-CSRF-Token"]

Python响应头包含X-CSRF-TOKEN

PHP 代码（无法获取Token） #

$curl = curl_init();
$authapi = "https://auth.roblox.com/";
$authcookie = "_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|...";
curl_setopt($curl, CURLOPT_URL, $authapi);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HEADER, true);
$cookie = ".ROBLOSECURITY=$authcookie";
curl_setopt($curl, CURLOPT_HTTPHEADER, array(
    "Content-Type: application/json",  'Cookie: ' . $cookie
));
curl_setopt($curl, CURLOPT_NOBODY, 0);
$response = curl_exec($curl);
$header_size = curl_getinfo($curl, CURLINFO_HEADER_SIZE);
$headers = substr($response, 0, $header_size);
$body = substr($response, $header_size);
echo $response;

PHP响应头中无X-CSRF-TOKEN

请问问题出在哪里？

问题分析与解决 #

核心问题有两个：

1. 请求方法不匹配：Python代码用的是POST请求，但PHP代码默认使用GET请求。Roblox的auth.roblox.com接口仅会在POST（或其他修改型请求）中返回X-CSRF-Token，GET请求不会触发Token下发。
2. Cookie设置方式不规范：PHP中通过CURLOPT_HTTPHEADER手动拼接Cookie可能出现格式问题，建议使用CURLOPT_COOKIE参数直接设置Cookie，更可靠。

另外，Python的POST请求默认不会携带Content-Type: application/json，而PHP代码额外添加了这个Header，可能导致接口处理逻辑异常，可暂时移除该Header。

修正后的PHP代码 #

$curl = curl_init();
$authapi = "https://auth.roblox.com/";
$authcookie = "_|WARNING:-DO-NOT-SHARE-THIS.--Sharing-this-will-allow-someone-to-log-in-as-you-and-to-steal-your-ROBUX-and-items.|...";

curl_setopt($curl, CURLOPT_URL, $authapi);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HEADER, true);
// 使用CURLOPT_COOKIE设置Cookie，而非手动拼接Header
curl_setopt($curl, CURLOPT_COOKIE, ".ROBLOSECURITY=$authcookie");
// 设置为POST请求，匹配Python的请求方法
curl_setopt($curl, CURLOPT_POST, true);

$response = curl_exec($curl);
$header_size = curl_getinfo($curl, CURLINFO_HEADER_SIZE);
$headers = substr($response, 0, $header_size);
$body = substr($response, $header_size);

// 解析响应头中的X-CSRF-Token
$csrfToken = null;
$headerLines = explode("\r\n", $headers);
foreach ($headerLines as $line) {
    if (stripos($line, "X-CSRF-Token:") !== false) {
        $csrfToken = trim(substr($line, strlen("X-CSRF-Token:")));
        break;
    }
}

echo "CSRF Token: " . $csrfToken . "\n";
echo "Headers:\n" . $headers;

curl_close($curl);

内容的提问来源于stack exchange，提问作者omamelo