Q:

Why 403 forbidden with curl where cookies seams to work?

In the below example can you see the output as comments which I base my conclusions on.
Based on the first, I say cookies are working, as it wants to redirect me to /project.
Question
Why do I get a 403 forbidden, now that I can see cookies are working?
user='testtest2@testtest2.com'
pass="a"
url="https://www.sharelatex.com"
zip="$url/project/579ba5e03cd63aa32d8bf922/download/zip"

cd /tmp
rm cookies.txt p.zip
csrf=""

csrf=$(curl -s -k --cookie-jar cookies.txt $url/login | perl -lne 'print $1 if /csrfToken = \"(.+?)\"/')

echo $csrf
cat cookies.txt

d="email=$user&password=$pass&_csrf=$csrf"

clear

curl -s -v -k -L --cookie cookies.txt -d $d $url/login

# * Connection #0 to host www.sharelatex.com left intact
# {"redir":"/project"}

clear

curl -s -v -k -L --cookie cookies.txt -d $d $url/project

# < HTTP/1.1 403 Forbidden

A:

Look at the output from the last login command which says
* Replaced cookie sharelatex_session

So you need to save the new cookie and use that.
user='testtest2@testtest2.com'
pass="a"
url="https://www.sharelatex.com"
zip="$url/project/579ba5e03cd63aa32d8bf922/download/zip"

cd /tmp
rm cookies.txt file.zip
csrf=""

csrf=$(curl -s -k --cookie-jar cookies.txt $url/login | perl -lne 'print $1 if /csrfToken = \"(.+?)\"/')

d="email=$user&password=$pass&_csrf=$csrf"

curl -s -v -k -L -c cookies.txt -b cookies.txt -d $d $url/login

curl -s -v -k -L --cookie cookies.txt  $zip -o file.zip
unzip -l file.zip

