Input session not migrated to new webpage using WebRequest / Response?

Question

Well, I've been racking my brains over this solo for too long. I could not crack it even with the hours spent on this and many other sites.

Essentially, I'm trying to remove some data from the webpage after the login page using WebRequest / Response. (I got this to work with the WebBrowser control with some multi-level events that go to different web pages, but this causes some problems when trying to refactor, not to mention that using the hidden form to work is a “bad” practice ").

This is what I have:

string formParams = string.Format("j_username={0}&j_password={1}", userName, userPass); string cookieHeader; WebRequest request = WebRequest.Create(_signInPage); request.ContentType = "text/plain"; request.Method = "POST"; byte[] bytes = Encoding.ASCII.GetBytes(formParams); request.ContentLength = bytes.Length; using (Stream os = request.GetRequestStream()) { os.Write(bytes, 0, bytes.Length); } WebResponse response = request.GetResponse(); cookieHeader = response.Headers["Set-Cookie"]; WebRequest getRequest = WebRequest.Create(sessionHistoryPage); getRequest.Method = "GET"; getRequest.Headers.Add("Cookie", cookieHeader); WebResponse getResponse = getRequest.GetResponse(); try { using (StreamReader sr = new StreamReader(getResponse.GetResponseStream())) { textBox1.AppendText(sr.ReadToEnd()); } } catch (Exception ex) { MessageBox.Show(ex.Message); throw; } 

Until now, I could go to the desired page from the first link, but when I go to the second, it sends me back to the login page, as if I had not entered.

The problem may be that cookies do not get right, but I'm new, so maybe I'm just mistaken. It captures cookies sent back from POST: JSESSIONID and S2V, however, when we go to "GET" using the FireFox WebConsole, the browser shows that it sends JSESSIONID, S2V and SPRING_SECURITY_REMEMBER_ME_COOKIE, which I believe are cookies, which are used when I click "Remember Me" in the login form.

I tried many different ways to do this using SO resources, but I still need to get to the page I need. So, for the sake of the hair that I have left, I decided to ask for help on a good ole. (This is one of those things I don’t want to miss - stubborn as it is sometimes)

If someone needs the actual address of the site I'm trying to access, I would be more than happy to send a couple of people in a private message.

The code I should reflect with Wal's suggested answer is:

 var request = (HttpWebRequest)WebRequest.Create(sessionHistoryPage); request.Credentials = new NetworkCredential(userName, userPass); request.CookieContainer = new CookieContainer(); request.PreAuthenticate = true; WebResponse getResponse = request.GetResponse(); try { using (StreamReader sr = new StreamReader(getResponse.GetResponseStream())) { textBox1.AppendText(sr.ReadToEnd()); } } catch (Exception ex) { MessageBox.Show(ex.Message); throw; } 

This proposal, at least the way I implemented it, did not help.

As Krizz said, I changed the code to use a CookieContainer and transferred cookies from one request to another, however the answer simply returns me to the original login page, as if I had not logged in.

Are there certain sites that simply DO NOT allow this behavior?

Final decision

The final solution was proposed by Adrian Ifod, where he stated that the website on which I am trying to log in may not allow authentication without a valid session, so adding GET to the beginning of the process allowed me to get this cookie.

Thank you all for your help!

Answer 1

I did some kind of cookie transfer for a site written in PHP. It’s clear that you are passing a cookie, but perhaps it’s like in this situation.

 var phpsessid = response.Headers["Set-Cookie"].Replace("; path=/", String.Empty); 

The Set-Cookie header contains other related cookie information and other other instructions for other cookies. I had one cookie with its information (Path), the session identifier that I need to send to the server so that the server knows that I am the same client that made the GET request.

A new request should have enabled this cookie.

 request.Headers["Cookie"] = phpsessid; 

You are already doing this, but make sure that the cookies you received are sent back to the server.

Given session and authentication, there are two cookies: one for the session, one for authentication, and some servers / applications may not be able to authenticate without a valid session. I want to say that you may also need to pass session cookies. So the steps are:

• Make a GET request first to get a session cookie.
• Then do a POST request to authenticate and get the auth cookie.
• Use both cookies to access secure pages.

Also check this question , it does not display the whole class, but the idea is to keep the CookieContainer in the same class, add new cookies from POST / GET and assign them to each new request, for example @Krizz.

Answer 2

Try using a CookieContainer , which is a class to maintain a cookie context between multiple requests. You just instantiate it and assign it to each WebRequest .

Therefore, changing your code:

 string formParams = string.Format("j_username={0}&j_password={1}", userName, userPass); string cookieHeader; var cookies = new CookieContainer(); // added this line var request = WebRequest.Create(_signInPage) as HttpWebRequest; // modified line request.CookieContainer = cookies; // added this line request.ContentType = "text/plain"; request.Method = "POST"; byte[] bytes = Encoding.ASCII.GetBytes(formParams); request.ContentLength = bytes.Length; using (Stream os = request.GetRequestStream()) { os.Write(bytes, 0, bytes.Length); } request.GetResponse(); // removed some code here, no need to read response manually var getRequest = WebRequest.Create(sessionHistoryPage) as HttpWebRequest; //modified line getRequest.CookieContainer = cookies; // added this line getRequest.Method = "GET"; WebResponse getResponse = getRequest.GetResponse(); try { using (StreamReader sr = new StreamReader(getResponse.GetResponseStream())) { textBox1.AppendText(sr.ReadToEnd()); } } catch (Exception ex) { MessageBox.Show(ex.Message); throw; }