原生PHP开发YouTube视频下载脚本遇签名验证403错误求助

Hey there! Let’s figure out why your PHP YouTube download script is hitting that 403 error for signed video links, even though saveform() works perfectly. I’ve dealt with this exact issue before, so here’s what’s going on and how to fix it:

Why You’re Getting the 403 Error #

1. Your Request Doesn’t Look Like a Real Browser #

YouTube’s servers are strict about verifying that requests come from legitimate users (not bots). When you use saveform(), it’s probably mimicking all the headers and cookies a real browser sends. Your native PHP script, though, is likely sending minimal or generic headers that trigger YouTube’s anti-bot checks. The most commonly missing/incorrect headers are:

• User-Agent: A generic PHP UA string is a dead giveaway for a bot—you need to use a real browser’s UA (like Chrome or Firefox’s current string).
• Referer: YouTube checks that the request is coming from the original video page, so this header needs to point to the https://www.youtube.com/watch?v=YOUR_VIDEO_ID URL.
• Cookies: YouTube uses session cookies to validate access to signed content. If your script isn’t storing and reusing cookies from the initial video page request, the signed link will be rejected.
• Origin: This header tells YouTube the request is coming from their own domain, which helps bypass cross-origin restrictions.

2. The Signature Isn’t Tied to Your Session #

YouTube’s signed links (with the sig or s parameter) are tied to the specific session cookies from the request that fetched the link. If you grab the signed link with one session and try to download it with another (or no session), the server will block you. Saveform() is probably handling this session continuity automatically, but your script isn’t.

3. Anti-Bot Measures Are Flagging Your Request #

Beyond headers, YouTube looks for patterns like rapid requests, no cookie history, or generic behavior. Your script’s default HTTP client behavior is screaming “bot” to their servers.

Fixes for Your Native PHP Script #

Step 1: Replicate Browser Headers and Cookie Handling #

Update your download request to include all the necessary headers and persist cookies. Here’s a working curl example:

// Replace these with your actual values
$signedVideoUrl = "https://r4---sn-25glenes.googlevideo.com/...";
$videoPageUrl = "https://www.youtube.com/watch?v=YOUR_VIDEO_ID";

// Initialize curl with cookie handling
$ch = curl_init($signedVideoUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);

// Mimic a real Chrome browser's headers
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",
    "Referer: $videoPageUrl",
    "Origin: https://www.youtube.com",
    "Accept-Language: en-US,en;q=0.9",
    "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"
]);

// Save and reuse cookies (create a cookies.txt file in your script directory)
curl_setopt($ch, CURLOPT_COOKIEJAR, __DIR__ . "/cookies.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, __DIR__ . "/cookies.txt");

// Execute the request
$videoContent = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);

if ($httpCode === 200) {
    file_put_contents("downloaded_video.mp4", $videoContent);
    echo "Download successful!";
} else {
    echo "Error: HTTP $httpCode - " . curl_error($ch);
}

curl_close($ch);

Step 2: Fetch Links and Download with the Same Session #

Before grabbing the signed video links, first send a request to the YouTube video page using the same cookie jar. This establishes a valid session that the signed links will be tied to:

// First, visit the video page to get session cookies
$ch = curl_init($videoPageUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, __DIR__ . "/cookies.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, __DIR__ . "/cookies.txt");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
]);
curl_exec($ch);
curl_close($ch);

// Now fetch the video links and download using the same cookies...

Step 3: Avoid Bot Red Flags #

• Rotate your User-Agent string occasionally (use a list of real browser UAs instead of hardcoding one).
• Add small delays (1-2 seconds) between requests to mimic human browsing.
• Don’t spam requests—rate limit your downloads to avoid triggering YouTube’s blocks.

Step 4: Debug Request Differences #

Use your browser’s DevTools (Network tab) to inspect the exact headers and cookies that saveform() sends when downloading the video. Then replicate those headers and cookies exactly in your PHP script. This is the most reliable way to match the working request.

A Quick Heads-Up #

YouTube changes their signature algorithm and anti-bot measures regularly, so your script might need updates over time. Also, make sure you’re complying with YouTube’s Terms of Service—unofficial download tools can violate their policies.

内容的提问来源于stack exchange，提问作者Muhammad