Authorization in VK via cURL bypassing the API?

Question

PHP

Hello!
There is a task - to write a script that allows you to log in to VK with a username and password, imitating a browser.
There is a code that should work, but for some reason authorization does not occur. As I understand it, VK has some kind of protection (I know about checking IP, this is not the point, because the hosting from which I tried to do all this is Russian). But I don't understand which one. It looks like he reproduced everything exactly. Is it really some tricky timings (a real browser is slower)?
Here is my current code (written a year ago, could be somewhat outdated).

<?php

$str = file_get_contents("https://vk.com/login");
$doc = new DOMDocument();
$doc->loadHTML($str);
//print_r($doc->getElementById("login_form")->childNodes);

echo "<pre>\r\n";
foreach($doc->getElementById("login_form")->childNodes as $node) {
   if ($node->nodeType == 1 && $node->tagName == "input") {
      if ($node->getAttribute("name") == "ip_h") $ip_h = $node->getAttribute("value");
      if ($node->getAttribute("name") == "lg_h") $lg_h = $node->getAttribute("value");
      //echo $node->getAttribute("name").": ".$node->getAttribute("value")."<br />\r\n";
   }
}

$url = "https://vk.com/login?act=login";

$post_data = array (
    "act" => "login",
    "role" => "al_frame",
    "expire" => "",
    "captcha_sid" => "",
    "captcha_key" => "",
    "_origin" => "https://vk.com",
    "ip_h" => $ip_h,
    "lg_h" => $lg_h,
    "email": "[email protected]",
    "pass" => "PASSWORD"
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36");
curl_setopt($ch, CURLOPT_HEADER, 0);
curl_setopt($ch, CURLOPT_COOKIEJAR, "vg75hjg96.txt");
curl_setopt($ch, CURLOPT_COOKIEFILE, "vg75hjg96.txt");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
$output = curl_exec($ch);
curl_close($ch);

echo $output;

echo "</pre>\r\n";

?>

As a result, no authorization occurs.
By the way, I noticed a strange bug: in a browser with the correct password, authorization also sometimes does not happen the first time. At the same time, everything does not look quite the same as when entering the wrong password from the UI point of view, the error message is slightly different.
Any ideas what to do?

Answer 1

At the same time, I also stumbled across this.
I used the mobile version of the site for authorization - everything was OK there.
m.vk.com