Why am I getting a 500 error when I submit POST data to an ASP.NET MVC site via Android?

Question

I am trying to create an Android app to check my test scores of my engineering school. To download Word containing ratings, I need to go to the portal.

I thought it would be easy to do this by sending a POST request.

After circumventing the self-signed certificate issue (or something else) thanks to the code on this page: Self-signed SSL reception on Android

I still get a 500 error when trying to send any POST request to the login page that is here: https://e-campus.hei.fr/ERP-prod/pc_mv_login.aspx p>

I tried various codes from the Internet to send POST data (especially How to make an HTTP message in Android? This one). And even in a clean java application, I get 500.

When I point the URL to another test page, I manage to get it to work, but not to https://e-campus.hei.fr/ERP-prod/pc_mv_login.aspx

Can someone explain to me why this is not working or help me get rid of this error?

EDIT: This is what is sent through my browser (according to Chrome development tools)

__EVENTTARGET: __EVENTARGUMENT: __VIEWSTATE:dDwxNDU4ODc4MDI5O3Q8O2w8aTwwPjs+O2w8dDw7bDxpPDE+O2k8Nz47aTwxMz47aTwxNT47aTwxNz47aTwxOT47PjtsPHQ8cDxwPGw8VGV4dDs+O2w8SWRlbnRpZmlhbnQgOjs+Pjs+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8TW90IGRlIHBhc3NlIDo7Pj47Pjs7Pjt0PHA8cDxsPFRleHQ7PjtsPExhbmd1ZSA6Oz4+Oz47Oz47dDx0PDt0PGk8Mj47QDxBbmdsYWlzO0ZyYW7Dp2Fpczs+O0A8ZW47ZnI7Pj47bDxpPDE+Oz4+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8Vm91cyBuJ8OqdGVzIHBhcyBhdXRvcmlzw6kgIMOgIHZvdXMgY29ubmVjdGVyLjs+Pjs+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8Q29ubmVjdGVyIDo7Pj47Pjs7Pjs+Pjs+Pjs+inmhCwE9zfymuEXDXGORShkB1GI= Username:****** Password:****** Langues:fr Button1:Connecter : 

This is the line I'm sending:

 String parameters = "__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=" + URLEncoder .encode("dDwxNDU4ODc4MDI5O3Q8O2w8aTwwPjs+O2w8dDw7bDxpPDE+O2k8Nz47aTwxMz47aTwxNT47aTwxNz47aTwxOT47PjtsPHQ8cDxwPGw8VGV4dDs+O2w8SWRlbnRpZmlhbnQgOjs+Pjs+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8TW90IGRlIHBhc3NlIDo7Pj47Pjs7Pjt0PHA8cDxsPFRleHQ7PjtsPExhbmd1ZSA6Oz4+Oz47Oz47dDx0PDt0PGk8Mj47QDxBbmdsYWlzO0ZyYW7Dp2Fpczs+O0A8ZW47ZnI7Pj47bDxpPDE+Oz4+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8Vm91cyBuJ8OqdGVzIHBhcyBhdXRvcmlzw6kgIMOgIHZvdXMgY29ubmVjdGVyLjs+Pjs+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8Q29ubmVjdGVyIDo7Pj47Pjs7Pjs+Pjs+Pjs+inmhCwE9zfymuEXDXGORShkB1GI=", "UTF-8") + "&Username=" + URLEncoder.encode(mUsername, "UTF-8") + "&Password=" + URLEncoder.encode(mPassword, "UTF-8") + "&Langues=fr&Button1=" + URLEncoder.encode("Connecter :", "UTF-8"); + O2w8SWRlbnRpZmlhbnQgOjs + Pjs + Ozs + O3Q8cDxwPGw8VGV4dDs + O2w8TW90IGRlIHBhc3NlIDo7Pj47Pjs7Pjt0PHA8cDxsPFRleHQ7PjtsPExhbmd1ZSA6Oz4 + Oz47Oz47dDx0PDt0PGk8Mj47QDxBbmdsYWlzO0ZyYW7Dp2Fpczs + O0A8ZW47ZnI7Pj47bDxpPDE + Oz4 + Ozs + O3Q8cDxwPGw8VGV4dDs + O2w8Vm91cyBuJ8OqdGVzIHBhcyBhdXRvcmlzw6kgIMOgIHZvdXMgY29ubmVjdGVyLjs + Pjs + Ozs + O3Q8cDxwPGw8VGV4dDs + O2w8Q29ubmVjdGVyIDo7Pj47Pjs7Pjs + Pjs + Pjs + inmhCwE9zfymuEXDXGORShkB1GI =", String parameters = "__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=" + URLEncoder .encode("dDwxNDU4ODc4MDI5O3Q8O2w8aTwwPjs+O2w8dDw7bDxpPDE+O2k8Nz47aTwxMz47aTwxNT47aTwxNz47aTwxOT47PjtsPHQ8cDxwPGw8VGV4dDs+O2w8SWRlbnRpZmlhbnQgOjs+Pjs+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8TW90IGRlIHBhc3NlIDo7Pj47Pjs7Pjt0PHA8cDxsPFRleHQ7PjtsPExhbmd1ZSA6Oz4+Oz47Oz47dDx0PDt0PGk8Mj47QDxBbmdsYWlzO0ZyYW7Dp2Fpczs+O0A8ZW47ZnI7Pj47bDxpPDE+Oz4+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8Vm91cyBuJ8OqdGVzIHBhcyBhdXRvcmlzw6kgIMOgIHZvdXMgY29ubmVjdGVyLjs+Pjs+Ozs+O3Q8cDxwPGw8VGV4dDs+O2w8Q29ubmVjdGVyIDo7Pj47Pjs7Pjs+Pjs+Pjs+inmhCwE9zfymuEXDXGORShkB1GI=", "UTF-8") + "&Username=" + URLEncoder.encode(mUsername, "UTF-8") + "&Password=" + URLEncoder.encode(mPassword, "UTF-8") + "&Langues=fr&Button1=" + URLEncoder.encode("Connecter :", "UTF-8"); 

Answer 1

An HTTP 500 error means that the server-side code failed. It has an error, for example, NullPointerException . If the response body does not contain anything reasonable (for example, stacktrace) so that you can find out how it is called, and therefore modify the request accordingly, it is best to contact the server administrator and report this error to the server code and ask how to correctly execute software login.

If for some reason this is not an option, you should double-check that you remember to send a specific cookie, header and / or parameter. The server code probably expected this, but it was null , and the code was buggy, and therefore it completely broke with 500. I would suggest using Firebug to track all HTTP traffic and compare it with the headers / parameters you specify. Perhaps you need to send a specific cookie? Or do you need to send a name = value pair to the submit button? Etcetera.

---

Refresh : You are sending the wrong __VIEWSTATE value. The website runs on ASP.NET MVC, which is a component structure of MVC (for example, JSF in Java EE). It saves the component tree as a "view state". You should not send the random / nonexistent / invalid view state back as a parameter, but valid . You need to rewrite the HTTP client so that it first starts the GET request on the page with the form, and then uses the HTML parser ( Jsoup ?) To extract the value of the hidden input field __VIEWSTATE and finally run the POST request with this value (and for sure same cookie in the request header!).

As with JSF, view state is part of the prevention of CSRF attacks. You cannot submit a form without first requesting a form from the website itself in the same session.

---