优酷扫码登录协议

整体流程

优酷扫码登录基于阿里通行证（cnpassport.youku.com）实现，整个流程分两步：

1. 生成二维码：调用 qrcode/generate.do，拿到二维码图片地址以及 t、ck 两个关键参数
2. 轮询查询状态：用户扫码并在手机上确认后，调用 qrcode/query.do 换取登录凭证

下面直接给出 ThinkPHP 下的实现代码，可以直接套用。

查询扫码状态

// 定义目标 URL
$url = "https://cnpassport.youku.com/newlogin/qrcode/query.do?appName=youku&fromSite=23&_bx-v=2.5.19";

// 准备 POST 请求的参数
$data = [
    't' => Request::post('t'),
    'ck' => Request::post('ck'),
    'ua' => Request::post('ua'),
    'appName' => Request::post('appName'),
    'appEntrance' => Request::post('appEntrance'),
    '_csrf_token' => Request::post('_csrf_token'),
    'umidToken' => Request::post('umidToken'),
    'hsiz' => Request::post('hsiz'),
    'bizParams' => Request::post('bizParams'),
    'mainPage' => Request::post('mainPage'),
    'isMobile' => Request::post('isMobile'),
    'lang' => Request::post('lang'),
    'returnUrl' => Request::post('returnUrl'),
    'fromSite' => Request::post('fromSite'),
    'umidTag' => Request::post('umidTag'),
    'navlanguage' => Request::post('navlanguage'),
    'navUserAgent' => Request::post('navUserAgent'),
    'navPlatform' => Request::post('navPlatform'),
    'isIframe' => Request::post('isIframe'),
    'documentReferer' => Request::post('documentReferer'),
    'defaultView' => Request::post('defaultView'),
    'deviceId' => Request::post('deviceId'),
    'pageTraceId' => Request::post('pageTraceId'),
    'bx-ua' => Request::post('bx-ua'),
    'bx-umidtoken' => Request::post('bx-umidtoken')
];

获取登录二维码

public function getQrcode()
{
    $url = "https://cnpassport.youku.com/newlogin/qrcode/generate.do?appName=youku";

    $response = $this->curl_get($url);

    if ($response === false) {
        return ResponseUtils::error("请求失败，请检查网络或目标 URL 是否可用", 500);
    }

    $responseData = json_decode($response, true);

    if (isset($responseData['content']['data']['imgUrl'])) {
        // 返回 imgUrl 等数据
        return ResponseUtils::successData($responseData['content']['data']);
    } else {
        return ResponseUtils::error("响应数据格式错误或字段缺失", 500);
    }
}

注意事项

• generate.do 返回的 t 和 ck 是后续轮询的凭证，务必保存好
• 轮询接口建议间隔 2~3 秒，频率过高容易触发风控
• 扫码确认后返回的 cookie 才是最终目标，记得用 cookieJar 完整保存

交流微信：run1255