WebRequest and ASP username/password form authentication

[Tony]

Please help, I've scoured the web but cannot find an answer to this!

I want to use WebRequest to get the contents of a web page. The trouble is,
the page require you to go to a login page (using ASP - not ASP.NET), and
enter a username and password to get in.

How do I use WebRequest in this situation? I cannot find any way of
supplying the username and password. The '.Credentials' does not work because
that is only for Windows authentication, not forms authentication from the
web site.

Please help! At the moment I am forcing my user to go to the site and copy
and paste the text in. This is annoying because the content of the site
changes.

[Joerg Jooss]

Tony wrote:

Please help, I've scoured the web but cannot find an answer to this!

I want to use WebRequest to get the contents of a web page. The
trouble is, the page require you to go to a login page (using ASP -
not ASP.NET), and enter a username and password to get in.

How do I use WebRequest in this situation? I cannot find any way of
supplying the username and password. The '.Credentials' does not work
because that is only for Windows authentication, not forms
authentication from the web site.
You have to supply user name and password with a POST request yourself.
Please help! At the moment I am forcing my user to go to the site and
copy and paste the text in. This is annoying because the content of
the site changes.

First, you'll have to understand how the site actually works. Go to the
login page and check its HTML source. Look for the names of all input
controls related to login: user name, password, probably the login button as
well. This is the request data you want to send to login.

Next, look for the <form action="..."> tag that contains the login controls.
This is your HttpWebRequest's URI.

Assuming there's no client-side scripting or additional (hidden) fields,
that's all you need to create a HttpWebRequest instance for login.

You'll also need to understand how the web application implements session
tracking. You mentioned that it's an ASP application, so it's quite safe to
assume the web app is using cookies. Make sure to associate a
CookieContainer with all your HttpWebRequest objects in order to send the
session cookie with each subsequent request.

Cheers,
--
Joerg Jooss
jo*********@gmx.net

[Tony]

Hi Joerg.

Thanks for the reply. However, I think the site uses the GET method, not the
POST method. I have tried manually putting the address of the right page into
Internet Explorer with the field names and values, but it does not work.

Is there a way to do what you have recommended using GET? Also, I am not
sure about cookies. Is there a good beginner's reference on programming
cookies in C#?

Thanks in advance.

Tony

"Joerg Jooss" wrote:

Tony wrote:

Please help, I've scoured the web but cannot find an answer to this!

I want to use WebRequest to get the contents of a web page. The
trouble is, the page require you to go to a login page (using ASP -
not ASP.NET), and enter a username and password to get in.

How do I use WebRequest in this situation? I cannot find any way of
supplying the username and password. The '.Credentials' does not work
because that is only for Windows authentication, not forms
authentication from the web site.

You have to supply user name and password with a POST request yourself.

Please help! At the moment I am forcing my user to go to the site and
copy and paste the text in. This is annoying because the content of
the site changes.

First, you'll have to understand how the site actually works. Go to the
login page and check its HTML source. Look for the names of all input
controls related to login: user name, password, probably the login button as
well. This is the request data you want to send to login.

Next, look for the <form action="..."> tag that contains the login controls.
This is your HttpWebRequest's URI.

Assuming there's no client-side scripting or additional (hidden) fields,
that's all you need to create a HttpWebRequest instance for login.

You'll also need to understand how the web application implements session
tracking. You mentioned that it's an ASP application, so it's quite safe to
assume the web app is using cookies. Make sure to associate a
CookieContainer with all your HttpWebRequest objects in order to send the
session cookie with each subsequent request.

Cheers,
--
Joerg Jooss
jo*********@gmx.net

[Tony]

Ho Joerg,

There is a hidden input field called Validate. Does this impact the code? Do
I need to account for it?

<form name="LOG01" action="/WebETC/employee.login.asp?" method="POST"
onSubmit="return validateLOG01(this)">
<input type="hidden" name="Validate" ="1">
<table border="0" cellspacing="0" cellpadding="2">
<tr>
<td align="right"><p class="formcaption">Agent Login ID</p></td>
<td>
<input type="text" name="username" class="formfield" maxlength="9" value="">

"Joerg Jooss" wrote:

Tony wrote:

Please help, I've scoured the web but cannot find an answer to this!

I want to use WebRequest to get the contents of a web page. The
trouble is, the page require you to go to a login page (using ASP -
not ASP.NET), and enter a username and password to get in.

How do I use WebRequest in this situation? I cannot find any way of
supplying the username and password. The '.Credentials' does not work
because that is only for Windows authentication, not forms
authentication from the web site.

You have to supply user name and password with a POST request yourself.

Please help! At the moment I am forcing my user to go to the site and
copy and paste the text in. This is annoying because the content of
the site changes.

First, you'll have to understand how the site actually works. Go to the
login page and check its HTML source. Look for the names of all input
controls related to login: user name, password, probably the login button as
well. This is the request data you want to send to login.

Next, look for the <form action="..."> tag that contains the login controls.
This is your HttpWebRequest's URI.

Assuming there's no client-side scripting or additional (hidden) fields,
that's all you need to create a HttpWebRequest instance for login.

You'll also need to understand how the web application implements session
tracking. You mentioned that it's an ASP application, so it's quite safe to
assume the web app is using cookies. Make sure to associate a
CookieContainer with all your HttpWebRequest objects in order to send the
session cookie with each subsequent request.

Cheers,
--
Joerg Jooss
jo*********@gmx.net

[Joerg Jooss]

Tony wrote:

Hi Joerg.

Thanks for the reply. However, I think the site uses the GET method,
not the POST method.
That would be pretty stupid, as it exposes the password to the public --
it's appended to the URL. Note that unless the web application specifically
accepts or rejects GET or POST, both methods should work.
I have tried manually putting the address of the
right page into Internet Explorer with the field names and values,
but it does not work.
Yes, that's simple first test whether you've got all parameters right. Look
for hidden fields or JavsScript that is executed prior to form sumbmission.
Is there a way to do what you have recommended using GET?
Set your WebRequest's Method property to GET (it's the default anyway) and
append all required to the requested URI. You can use System.UriBuilder to
construct the URI with a properly encoded query string.
Also, I am
not sure about cookies. Is there a good beginner's reference on
programming cookies in C#?

There's actually little you have to do. Simply create a
System.Net.CookieContainer with your first request and reuse this instance
with all subsequent requests.

CookieContainer cookieContainer = new CookieContainer();
HttpWebRequest firstRequest
= (HttpWebRequest) WebRequest.Create("http://host/path/to/login.asp");
firstRequest .CookieContainer = cookieContainer;

....

HttpWebRequest secondRequest
= (HttpWebRequest) WebRequest.Create("http://host/path/to/page.asp");
secondRequest .CookieContainer = cookieContainer;

As a client, all you need to do is make sure the server gets its cookies
back. The CookieContainer does all of the magic begind the scenes, you just
need to make sure it's available to your request.
Cheers,
--
Joerg Jooss
jo*********@gmx.net

[Joerg Jooss]

Tony wrote:

Ho Joerg,

There is a hidden input field called Validate. Does this impact the
code? Do I need to account for it?
Most likely.

<form name="LOG01" action="/WebETC/employee.login.asp?" method="POST"
onSubmit="return validateLOG01(this)">
<input type="hidden" name="Validate" ="1">

Check what the script function validateLOG01 does -- maybe it writes to this
or another hidden field.

Cheers,

--
Joerg Jooss
jo*********@gmx.net