Goal:

Log into processor's site using their API and store the success response into COOKIEs and SESSIONs on my site.

What almost works:

jQuery(document).ready(function($){
    $.ajax({
      type: 'POST',
      url: '{url-to-api-call}',
      xhrFields: {
        withCredentials: true
      },
      dataType: 'text',
      data: 'Email={email}&GuestSessionToken={token}&Password={pass}&Format=JSON&RememberMe=true',
      processData: false,
      crossDomain: true,
      success: function (res) { console.log('success'); },
      error: function (jqXHR, textStatus, ex) {
          console.log('error');
      }
    });
});

Why it doesn't work: I'm unable to store the response to COOKIEs and SESSIONs.

What I would like to work:

$url = {url-to-api};
$curl = curl_init();
$curl_post_data = array(
    'Email' => $fields['user_email'],
    'GuestSessionToken' => $_COOKIE['SessionToken'],
    'Password' => $fields['user_pass'],
    'Format' => "JSON",
    'RememberMe' => "true"
);
curl_setopt($curl,CURLOPT_URL,$url);
curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($curl,CURLOPT_RETURNTRANSFER,true);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, $curl_post_data);
curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,5);
curl_setopt($curl, CURLOPT_TIMEOUT, 90);

$content = curl_exec($curl);
curl_close($curl);
$content_array = json_decode($content, true);

if ($content_array['StatusCode'] == 'OK') {
    $fields['UserId'] = $content_array['Data']['UserId'];
    $fields['SessionID'] = $content_array['Data']['ID'];
    $fields['SessionToken'] = $content_array['Data']['Token'];
    return true;
} else {
    $errors->add( 'error', 'Unable to sign in.' );
    return false;
}

Why it doesn't work: This will return a success response that I can use to set the COOKIEs and SESSIONs, but it will not log the user into the processor's site.

Why I think it doesn't work: The ajax call wouldn't sign the user in until I added the xhrFields part. I think if I could find a cURL equivalent for the xhrFields part, I would be all set.

Thanks in advance!

My duct tape fix.

<?php

// If signin form is submitted and signin cURL was successful.
echo (isset($fields['signin_script'])) ? $fields['signin_script'] : "";

function processor_signin(&$fields, &$errors) {

    $url = '{url-to-api-call}';
    $curl = curl_init();
    $curl_post_data = array(
        'Email' => $fields['user_email'],
        'GuestSessionToken' => $_COOKIE['SessionToken'],
        'Password' => $fields['user_pass'],
        'Format' => "JSON",
        'RememberMe' => "true"
    );
    curl_setopt($curl,CURLOPT_URL,$url);
    curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($curl,CURLOPT_RETURNTRANSFER,true);
    curl_setopt($curl, CURLOPT_POST, true);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $curl_post_data);
    curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,5);
    curl_setopt($curl, CURLOPT_TIMEOUT, 90);

    $content = curl_exec($curl);
    curl_close($curl);
    $content_array = json_decode($content, true);

    if ($content_array['StatusCode'] == 'OK') {
        $fields['UserId'] = $content_array['Data']['UserId'];
        $fields['SessionID'] = $content_array['Data']['ID'];
        $fields['SessionID'] = $content_array['Data']['ID'];
        $fields['SessionToken'] = $content_array['Data']['Token'];

        // Duct tape fix
        $fields['signin_script'] = "
        <script>
            jQuery(document).ready(function($){
                $.ajax({
                  type: 'POST',
                  url: '{url-to-api-call}',
                  xhrFields: {
                    withCredentials: true
                  },
                  dataType: 'text',
                  data: '
                    Email=".$fields['user_email']."
                    &GuestSessionToken=".$_COOKIE['SessionToken']."
                    &Password=".$fields['user_pass']."
                    &Format=JSON
                    &RememberMe=true',
                  processData: false,
                  crossDomain: true,
                  success: function (res) { console.log('signin success'); },
                  error: function (jqXHR, textStatus, ex) {
                      console.log('signin error');
                  }
                });
            });
        </script>
        ";

        return true;
    } else {
        $errors->add( 'error', 'Unable to sign in.' );
        return false;
    }

}
?>

Maybe you are logged in but you are not storing the cookies.

So you need to parse the headers and in the end store all cookies. In proceeding requests you need to send back all cookies that you retrieved before.

Here is an example how to retrieve the cookies and other headers from the server:

public function sendRequest(HttpRequest $request) 
{
    ...
    curl_setopt($ch, CURLOPT_HTTPHEADER, $request->getHeaders());
    curl_setopt($ch, CURLOPT_HEADER, true);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_HEADERFUNCTION, [$this, 'fetchHeader']);
    ...
    $content = curl_exec($ch);
    ...
}

/**
 * @param resource $ch     - curl handle
 * @param string   $header
 *
 * @return int
 */
private function fetchHeader($ch, $header)
{
    $headerParts = explode(': ', $header, 2);
    if (2 === count($headerParts)) {
        $headerName = strtolower($headerParts[0]);
        if ('set-cookie' === $headerName) {
            $this->responseHeaders[$headerName][] = trim($headerParts[1]);
            return strlen($header);
        }
        $this->responseHeaders[$headerName] = trim($headerParts[1]);
    }
    return strlen($header);
}