Form Login Help

[mcfly1204]

I am attempting to use WebRequest to access a page that requires a login/password to access. My last WebRequest continues to timeout. Any help or thoughts would be appreciated.

 
namespace FormsAuthTest
{
class Program
{
static void Main(string[] args)
{
HttpWebRequest request = null;
HttpWebResponse response = null;
StreamReader sr = null;
string originalUri = https://springboard.4imprint.com/PO/...112-46E9573F62;
System.Diagnostics.ConsoleTraceListener trace =
new System.Diagnostics.ConsoleTraceListener();
//
// Request page protected by forms authentication.
// This request will get a 302 to login page
//
trace.Write("Requesting : " + originalUri);
request = (HttpWebRequest)WebRequest.Create(originalUri);
request.CookieContainer = new CookieContainer();
request.AllowAutoRedirect = false;
response = (HttpWebResponse)request.GetResponse();
if (response.StatusCode == HttpStatusCode.Found)
{
trace.Write("Response: 302 ");
trace.WriteLine(response.StatusCode);
}
else
{
trace.Fail("Response status is " + response.StatusCode + ". Expected was Found");
}
//
// Get the url of login page from location header
//
String locationHeader = response.GetResponseHeader("Location");
trace.WriteLine("Location header is " + locationHeader);
trace.WriteLine("");
//
// Request login page
//
String loginPageUrl = "https://springboard.4imprint.com" + locationHeader;
Console.WriteLine("Requesting " + loginPageUrl);
request = (HttpWebRequest)WebRequest.Create(loginPageUrl);
request.CookieContainer = new CookieContainer();
request.AllowAutoRedirect = false;
response = (HttpWebResponse)request.GetResponse();
if (response.StatusCode == HttpStatusCode.OK)
{
trace.Write("Response: 200 ");
trace.WriteLine(response.StatusCode);
}
else
{
trace.Fail("Response status is " + response.StatusCode + ". Expected was OK");
}
trace.WriteLine("Parsing login page to create post message");
trace.WriteLine("");
sr = new StreamReader(response.GetResponseStream());
String loginResponse = sr.ReadToEnd();
sr.Close();
String eventTargetVar = "__EVENTTARGET=";
String eventTargetValue = "";
String eventArgumentVar = "__EVENTARGUMENT=";
String eventArgumentValue = "";
String viewStateVar = "__VIEWSTATE=";
String viewStateSearchString = "name=\"__VIEWSTATE\" id=\"__VIEWSTATE\" value=\"";
int viewStateStartIndex = loginResponse.IndexOf(viewStateSearchString);
loginResponse = loginResponse.Substring(viewStateStartIndex + viewStateSearchString.Length);
String viewStateValue = Uri.EscapeDataString(
loginResponse.Substring(0, loginResponse.IndexOf("\" />"))
);
loginResponse = loginResponse.Substring(loginResponse.IndexOf("\" />"));
String lcSearchStr = "input name=";
int lcSearchIndex = 0;
//
// Look for logon control id
// Use any valid username and password
//
lcSearchIndex = loginResponse.IndexOf(lcSearchStr);
loginResponse = loginResponse.Substring(lcSearchIndex + lcSearchStr.Length + 1);
String userNameVar = Uri.EscapeDataString(
loginResponse.Substring(0, loginResponse.IndexOf("\""))
) + "=";
String userNameValue = "username";
lcSearchIndex = loginResponse.IndexOf(lcSearchStr);
loginResponse = loginResponse.Substring(lcSearchIndex + lcSearchStr.Length + 1);
String passwordVar = Uri.EscapeDataString(
loginResponse.Substring(0, loginResponse.IndexOf("\""))
) + "=";
String passwordValue = "password";
lcSearchStr = "type=\"submit\" name=";
lcSearchIndex = loginResponse.IndexOf(lcSearchStr);
loginResponse = loginResponse.Substring(lcSearchIndex + lcSearchStr.Length + 1);
String loginButtonVar = Uri.EscapeDataString(
loginResponse.Substring(0, loginResponse.IndexOf("\""))
) + "=";
String loginButtonValue = "Log+In";
String eventValidationVar = "__EVENTVALIDATION=";
String eventValSearchString =
"name=\"__EVENTVALIDATION\" id=\"__EVENTVALIDATION\" value=\"";
int eventValStartIndex = loginResponse.IndexOf(eventValSearchString);
loginResponse = loginResponse.Substring(eventValStartIndex + eventValSearchString.Length);
String eventValidationValue =
Uri.EscapeDataString(
loginResponse.Substring(0, loginResponse.IndexOf("\" />"))
);
String postString = eventTargetVar + eventTargetValue;
postString += "&" + eventArgumentVar + eventArgumentValue;
postString += "&" + viewStateVar + viewStateValue;
postString += "&" + userNameVar + userNameValue;
postString += "&" + passwordVar + passwordValue;
postString += "&" + loginButtonVar + loginButtonValue;
postString += "&" + eventValidationVar + eventValidationValue;
//
// Do a POST to login.aspx now
//
Console.WriteLine("POST request to https://springboard.4imprint.com" + locationHeader);
request = (HttpWebRequest)WebRequest.Create("https://springboard.4imprint.com" + locationHeader);
request.CookieContainer = new CookieContainer();
request.AllowAutoRedirect = false;
request.Method = "POST";
request.ContentType = "application/x-www-form-urlencoded";
System.Text.ASCIIEncoding encoding = new System.Text.ASCIIEncoding();
byte[] requestData = encoding.GetBytes(postString);
request.ContentLength = requestData.Length;
Stream requestStream = request.GetRequestStream();
requestStream.Write(requestData, 0, requestData.Length);
requestStream.Close();
response = (HttpWebResponse)request.GetResponse();
if (response.StatusCode == HttpStatusCode.Found)
{
trace.Write("Response: 302 ");
trace.WriteLine(response.StatusCode);
}
else
{
trace.Fail("Response status is " + response.StatusCode + ". Expected was Found");
}
locationHeader = response.GetResponseHeader("Location");
trace.WriteLine("Location header is " + locationHeader);
CookieCollection cookies = response.Cookies;
 
 
//
 
// Send request to originalUri with the cookie
// We should be able to see originalUri contents
//
trace.WriteLine("Requesting https://springboard.4imprint.com" + locationHeader + " with cookie");
request = (HttpWebRequest)WebRequest.Create("https://springboard.4imprint.com" + locationHeader);
request.CookieContainer = new CookieContainer();
foreach(Cookie oneCookie in cookies)
{
request.CookieContainer.Add(oneCookie);
}
request.AllowAutoRedirect = false;
//request.Headers.Add(HttpRequestHeader.Cookie, cookie);
response = (HttpWebResponse)request.GetResponse();
if (response.StatusCode == HttpStatusCode.OK)
{
trace.Write("Response: 200 ");
trace.WriteLine(response.StatusCode);
}
else
{
trace.Fail("Response status is " + response.StatusCode + ". Expected was OK");
}
trace.WriteLine("");
trace.WriteLine("Contents of " + originalUri);
trace.WriteLine("");
sr = new StreamReader(response.GetResponseStream());
trace.WriteLine(sr.ReadToEnd());
sr.Close();
Console.Read();
}
}
}
 

[Plater]

Hmm. Are you remembering to add the Session cookie as well? Its not a regular cookie but a special header in the request.

Other then that I could only guess that you should get a packet watcher and see what data is being sent back and forth?

[mcfly1204]

You are indeed correct, the session cookie was not being stored. I will have to look into how I can save the cookies from each response object and then add them to my final request.

[mcfly1204]

So I have added the following to each HttpWebRequest:

request.CookieContainer = new CookieContainer();

I now have one CookieCollection that saves the session cookie, and another CookieCollection that saves two cookies to authenticate to the site. I then iterate through each CookieCollection, adding each cookie to the final request as such:

 
foreach (oneCookie in myCollection)
{
request.CookieContainer.Add(oneCookie
}
 

I can view each cookie, but I cannot get the final response that I am looking for.

[Plater]

When you packet watch, do they all show up in the transfer?

[mcfly1204]

Going to have to read about packet sniffing, and then I'll get back to you.