Linux CLI下CURL请求遇403错误，浏览器可正常访问求排查

Hey fellow dev, sorry to hear you're stuck on this 403 issue—let's break this down step by step since browser access works but CLI/curl doesn't:

1. First, Replicate the Exact Browser Request in CLI #

The easiest way to rule out missing headers is to copy the full working request from your browser and run it directly in your Linux terminal:

• Open your browser's DevTools (F12), go to the Network tab
• Find the successful API request, right-click it → "Copy" → "Copy as cURL"
• Paste that command into your Linux CLI and run it

If this works, compare it to your original curl/PHP request—you'll likely spot missing headers (like Cookie, Referer, Accept or Accept-Encoding) that the server expects. Even if you added a User-Agent, other headers might be required for the server to accept the request.

2. Check for Server-Side Restrictions #

403 errors often come from server rules that block non-browser traffic:

• WAF/ModSecurity Rules: Many servers use WAFs that flag requests without a full set of browser-like headers, or that have unusual request patterns. Even a correct User-Agent might not bypass this if other headers are missing.
• IP Whitelisting: Is the Linux server's IP allowed to access the API? Your browser might be using a different IP (e.g., your local machine vs. a remote server) that's whitelisted, while the CLI server isn't.
• Session/Cookie Requirements: If the API requires authentication via cookies (e.g., you're logged in via browser), your CLI/PHP request won't have those cookies by default. You'll need to extract the session cookie from your browser and add it to your curl/PHP request with the Cookie header.

3. Audit Your PHPCaller Implementation #

Looking at your code snippet, the PHPCaller class is handling the request under the hood—you'll want to verify how it's configuring curl:

• Does it set all necessary request headers (matching the browser's successful request)?
• Does it support passing cookies or session data?
• Is it using the same HTTP method (GET/POST) as the browser request? Sometimes a wrong method can trigger 403 even if the URL is correct.

You could temporarily add debug code to PHPCaller.php to output the full curl command/headers it's sending, so you can compare it to the working browser request.

4. Test with Raw Curl First (Bypass PHP) #

To isolate whether the issue is with your PHP code or the server's response to CLI traffic, run a simple raw curl command with all browser-like headers:

curl -X GET "https://your-api-url.com/search?mobile=123456" \
  -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" \
  -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8" \
  -H "Accept-Language: en-US,en;q=0.5" \
  -H "Referer: https://your-browser-referer-url.com/" \
  -H "Cookie: YOUR_SESSION_COOKIE_FROM_BROWSER"

If this works, the problem is definitely in how your PHPCaller is configuring the request. If it still fails, double-check IP restrictions or server-side logs for more details.

5. Check Server Error Logs #

If you have access to the API server's logs, look for the 403 entries—they'll usually include a reason (e.g., "WAF blocked request", "IP not whitelisted", "Missing authentication cookie"). This is often the fastest way to pinpoint the root cause.

内容的提问来源于stack exchange，提问作者PHP Lover