I have created a script to automate downloading a file created by an app that sends an email notice to the user when the file is generated. This script logs in, then executes a second time with some session items set on the host site and is able to download the file. 

Recently the host site created an update with some addition verification and since my script has not been working. I have implemented everything related to the updated verification process to ensure basically that XSS attacks are mitigated but I am running into a road block where now a set of GUID values are not in "Set-Cookie:" any longer. 

I am first making a GET to the login page to get the unique values for that attempt. 

```
$url = "https://loginurl.com/";

$options = array(
    'https' => array(
        'header' => "",
        'method' => 'GET',
        'content' => "",
    ),
);
$post_context = stream_context_create($options);

$post_raw_result = file_get_contents($url, false, $post_context);

$unique_headers = $http_response_header;

```

I assign the http\_response\_header and then pick some values I need but it doesnt contain all the cookies I see in the browser.

I have worked with curl, executing curl from shell\_exec() and over the past few weeks and file\_get seems to be the best option for me but I have no ideal why I cant see these GUID items any more.. I can see them in chrome or Mozilla when inspecting the communication. I thought it may be something with multiple cookies and tried several items like: 

```
$cookies_array = array();
foreach($http_response_header as $s)
{
  if (preg_match('|^Set-Cookie:\s*([^=]+)=([^;]+);(.+)$|', $s, $parts))
  {
    $cookies_array[] = $parts[1] . '=' . $parts[2];
  }
}

```

found [here](https://stackoverflow.com/questions/21984126/file-get-contents-get-cookies) and on a few other threads for similar questions but this doesnt seem to capture any additional info. 

I had some luck finding more data by checking $\_COOKIE but still didnt contain 2 of the GUID values I needed.

I even moved to postman and could see the same cookies defined there that I cannot seem to capture with php. Any ideas why they wouldnt be in the http\_header\_response or where else to look?