0

I am working on a console application that needs to log into a website to download a text file - and the login process is giving me some trouble. The login form has 2 textfields (username and password) and also a hidden input field for the form-key. I'm no experienced web developper but I assume that a PHP script generates this key and stores it in my session. If this key is not submitted correctly, the browser will just re-open the login page. I can see this key when I look at the website source code but I don't know how to get this value programatically.

So far I'm doing the following:

Dim cookies As New CookieCollection
Dim cookieRequest As HttpWebRequest = WebRequest.Create("https://www.website.com/customer/account/login/")
cookieRequest.CookieContainer = New CookieContainer()
cookieRequest.CookieContainer.Add(cookies)
Dim cookieResponse As HttpWebResponse = cookieRequest.GetResponse
cookies = cookieResponse.Cookies

Later in my code, I use the obtained cookies to create a CookieAwareWebClient object which would then send the necessary data to the website with a POST request to log in and also download the file I want:

Dim cookieJar As New CookieContainer
cookieJar.Add(cookies)
Dim client As New CookieAwareWebClient(cookieJar)
Dim reqparm As New Specialized.NameValueCollection
reqparm.Add("username", "<my_username>")
reqparm.Add("passwd", "<my_password>")
reqparm.Add("form_key", "??????")
Dim responsebytes = client.UploadValues("https://www.website.com/customer/account/loginPost/", "POST", reqparm)
Dim responsebody = (New Text.UTF8Encoding).GetString(responsebytes)   
' validate login if it works...
Dim strDL As String = client.DownloadString("https://www.website.com/downloadFile.php")

So basically my question would be: Is it possible to obtain the form_key value before I post the data with my web-client or is this designed specifically to prevent someone from accessing the website like that?

RaineWingel
  • 25
  • 2
  • As mentioned in your [previous post](https://stackoverflow.com/q/65718094/7444103), if you want to use HttpWebRequest (or WebClient, same thing), you have to parse the Response HTML (your Login Page) and extract all `` elements, hidden included, and post them as Key-Value pairs URL-Encoded. OR, use a WebBrowser class (**class**, not **Control**, AKA a headless-browser) to perform these operations. You can log in a Web Page setting only the visible elements values using the standard methods `GetElementsByTagName()`, `GetElementById()` etc. + `SetValue()`. – Jimi Jan 15 '21 at 13:11
  • If you use HttpWebRequest, you also have to handle the Redirections: the first comes from a `200 - OK` + Location Header set, which sends you to the Login page; one or more other redirections (`301-303`) - if the Login is successful - which point you to the Resource you asked for. – Jimi Jan 15 '21 at 13:13

0 Answers0