为什么我不能使用HttpClient 登录这个ASP.NET 网站？

Question

有一个来自第三方的 ASP.NET 网站需要登录。我需要从网站获取一些数据并对其进行解析，所以我想我会使用 HttpClient 来 post 网站的必要凭据，就像浏览器一样。然后，在 POST 请求之后，我认为我可以使用收到的 cookie 值进一步请求（仅授权）urls.

我已经到了可以成功 POST 登录凭据 url 并收到三个 cookie 的地步：ASP.NET_SessionId、.ASPXAUTH 和一个自定义值由网站本身使用，每个都有自己的价值。我认为由于我设置的 HttpClient 使用的是使用 CookieContainer 的 HttpHandler，因此 cookie 将与每个进一步的请求一起发送，并且我将保持登录状态。

但是，这似乎不起作用。如果我使用相同的 HttpClient 实例然后请求网站的安全区域之一，我只是再次获得登录表单。代码：

        const string loginUri = "https://some.website/login";

        var cookieContainer = new CookieContainer();
        var clientHandler = new HttpClientHandler() { CookieContainer = cookieContainer, AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate };
        var client = new HttpClient(clientHandler);
        client.DefaultRequestHeaders.Accept.Clear();
        client.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

        var loginRequest = new HttpRequestMessage(HttpMethod.Post, loginUri);

        // These form values correspond with the values posted by the browser
        var formContent = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("customercode", "password"),
            new KeyValuePair<string, string>("customerid", "username"),
            new KeyValuePair<string, string>("HandleForm", "Login")
        });

        loginRequest.Content = formContent;

        loginRequest.Headers.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393");
        loginRequest.Headers.Referrer = new Uri("https://some.website/Login?ReturnUrl=%2f");
        loginRequest.Headers.Host = "some.website";
        loginRequest.Headers.Connection.Add("Keep-Alive");
        loginRequest.Headers.CacheControl = new System.Net.Http.Headers.CacheControlHeaderValue() { NoCache = true };
        loginRequest.Headers.AcceptLanguage.ParseAdd("nl-NL");
        loginRequest.Headers.AcceptEncoding.ParseAdd("gzip, deflate");
        loginRequest.Headers.Accept.ParseAdd("text/html, application/xhtml+xml, image/jxr, */*");

        var response = await client.SendAsync(loginRequest);
        var responseString = await response.Content.ReadAsStringAsync();

        var cookies = cookieContainer.GetCookies(new Uri(loginUri));

当使用正确的凭据时，cookie 包含三项，包括一个 .ASPXAUTH cookie 和一个表明登录成功的会话 ID。然而：

        var text = await client.GetStringAsync("https://some.website/secureaction");

...这又是 returns 登录表单，而不是我使用浏览器登录并导航到 /secureaction 时获得的内容。

我错过了什么？

编辑： 这是我的应用程序发出的完整请求和 chrome 发出的请求。它们是相同的，除了 cookie 值。我运行他们通过 windiff：标记为的行是由 Chrome 发送的。

GET https://some.website/secureaction 
Connection: keep-alive  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36  
Accept-Encoding: gzip, deflate, sdch, br 
Upgrade-Insecure-Requests: 1  
Host: some.website  
Accept-Language:nl-NL, 
>> nl;q=0.8,en-US;q=0.6,en;q=0.4

Accept: text/html, 
>> application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Cookie: 
<!      customCookie=7CF190C0; 
<!          .ASPXAUTH=37D61E47(shortened for readability); 
<!      ASP.NET_SessionId=oqwmfwahpvf0qzpiextx0wtb 
!>      ASP.NET_SessionId=kn4t4rmeu2lfrgozjjga0z2j;          
!>          customCookie=8D43E263; 
!>          .ASPXAUTH=C2477BA1(shortened for readability)

HttpClient 应用程序获得对 /login 的 302 引用，Chrome 获得包含所请求页面的 200 响应。

Answer 1

按照要求，下面是我最终实现它的方法。我必须先对 /login 执行一个简单的 GET 请求，然后然后使用登录凭据执行 POST。我不记得那个 GET 到底设置了什么值（我假设一个带有服务器想要的编码值的 cookie），但是 HttpClient 无论如何都会处理这些 cookie，所以它可以正常工作。这是最终的工作代码：

    const string loginUri = "https://some.website/login";

    var cookieContainer = new CookieContainer();
    var clientHandler = new HttpClientHandler() 
    { 
        CookieContainer = cookieContainer, 
        AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate 
    };

    var client = new HttpClient(clientHandler);
    client.DefaultRequestHeaders.Accept.Clear();
    client.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

    // First do a GET to the login page, allowing the server to set certain 
    // required cookie values.
    var initialGetRequest = new HttpRequestMessage(HttpMethod.GET, loginUri);
    await client.SendAsync(initialGetRequest);

    var loginRequest = new HttpRequestMessage(HttpMethod.Post, loginUri);

    // These form values correspond with the values posted by the browser
    var formContent = new FormUrlEncodedContent(new[]
    {
        new KeyValuePair<string, string>("customercode", "password"),
        new KeyValuePair<string, string>("customerid", "username"),
        new KeyValuePair<string, string>("HandleForm", "Login")
    });

    loginRequest.Content = formContent;

    loginRequest.Headers.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393");
    loginRequest.Headers.Referrer = new Uri("https://some.website/Login?ReturnUrl=%2f");
    loginRequest.Headers.Host = "some.website";
    loginRequest.Headers.Connection.Add("Keep-Alive");
    loginRequest.Headers.CacheControl = new System.Net.Http.Headers.CacheControlHeaderValue() { NoCache = true };
    loginRequest.Headers.AcceptLanguage.ParseAdd("nl-NL");
    loginRequest.Headers.AcceptEncoding.ParseAdd("gzip, deflate");
    loginRequest.Headers.Accept.ParseAdd("text/html, application/xhtml+xml, image/jxr, */*");

    var response = await client.SendAsync(loginRequest);
    var responseString = await response.Content.ReadAsStringAsync();

    var cookies = cookieContainer.GetCookies(new Uri(loginUri));

为什么我不能使用HttpClient 登录这个ASP.NET 网站？

Why can't I use HttpClient to log in to this ASP.NET website?

c#

asp.net

authentication

cookies

dotnet-httpclient