使用HttpWebRequest登录到网站Fshare总是错误400

Question

I use HttpWebRequest for login to web site Fshare.vn. I used live HTTP header addon firefox for catch login parametter . I debuged and see my login param same as browers login but HttpWebRequest.GetResponse() always throws error 400 bad request. I tried use browser login param I catched but it always throws error 400.

This is my code

please help me! thank for all! string Url = " https://www.fshare.vn/login ";

string myParameters = string.Format("fs_csrf={0}&LoginForm%5Bemail%5D={1}&LoginForm%5Bpassword%5D={2}&LoginForm%5BrememberMe%5D=1&yt0=%C4%90%C4%83ng+nh%E1%BA%ADp",fs_csrf, System.Net.WebUtility.UrlEncode(userName),System.Net.WebUtility.UrlEncode(passWorld));
            br.sendDataPost(myParameters);

public string sendDataPost(string myParameters)
    {
        CookieContainer cookie = new CookieContainer();
        HttpWebRequest request = (HttpWebRequest)WebRequest.Create(URI);
        request.Method = "POST";
        request.ContentType = "application/x-www-form-urlencoded";
        request.Referer = URI;
        request.UserAgent = "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0";
        string postData = myParameters;
        request.KeepAlive = true;
        request.Accept = "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8";
        //request.Headers.Add("accept","text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
        //request.Headers.Add("accept-encoding","gzip, deflate");
        //request.Headers.Add("accept-language","en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,vi;q=0.2");
        request.KeepAlive = false;
        request.SendChunked = true;
        request.AutomaticDecompression=DecompressionMethods.GZip;
        request.ProtocolVersion = HttpVersion.Version11;
        request.AllowAutoRedirect = true;
        byte[] bytes = Encoding.UTF8.GetBytes(postData);
        request.CookieContainer = cookies;
        request.ContentLength = bytes.Length;
        request.Proxy = proxy;

        Stream requestStream = request.GetRequestStream();
        requestStream.Write(bytes, 0, bytes.Length);
        request.AllowAutoRedirect = false;
        request.ProtocolVersion = HttpVersion.Version11;
       // requestStream.Close();

        WebResponse response = request.GetResponse();
        Stream stream = response.GetResponseStream();
        StreamReader reader = new StreamReader(stream);

        var result = reader.ReadToEnd();
        stream.Dispose();
        reader.Dispose();
        return result.ToString();
    }

Answer 1

Here's how you get it to work (tested):

public string sendDataPost()
        {
            string url = "https://www.fshare.vn/login";
            string fsCsrf = "";
            Regex regEx = new Regex(@"<input type=""hidden"" value=""(.*)"" name=""fs_csrf"" \/>");

            CookieContainer cookie = new CookieContainer();
            HttpWebRequest initialRequest = (HttpWebRequest)WebRequest.Create(url);            
            initialRequest.CookieContainer = cookie;            
            HttpWebResponse getCookiesResponse = (HttpWebResponse)initialRequest.GetResponse();
            using (StreamReader sr = new StreamReader(getCookiesResponse.GetResponseStream()))
            {
                string responseHtml = sr.ReadToEnd();
                Match match = regEx.Match(responseHtml);
                if (match.Groups.Count > 1)
                    fsCsrf = match.Groups[1].Value;
            }

            if (!string.IsNullOrEmpty(fsCsrf))
            {
                HttpWebRequest request = (HttpWebRequest)WebRequest.Create(url);
                request.Method = "POST";
                request.ContentType = "application/x-www-form-urlencoded";                                                                
                request.CookieContainer = cookie;

                string username = "user";
                string password = "pass";
                string postData = "fs_csrf=" + fsCsrf + "&LoginForm%5Bemail%5D=" + username + "&LoginForm%5Bpassword%5D=" + password + "&LoginForm%5BrememberMe%5D=0&yt0=%C4%90%C4%83ng+nh%E1%BA%ADp";                                

                using (Stream requestStream = request.GetRequestStream())
                using (StreamWriter requestStreamWriter = new StreamWriter(requestStream))
                {                    
                    requestStreamWriter.Write(postData);
                    requestStreamWriter.Flush();
                    WebResponse response = request.GetResponse();                    

                    using (Stream stream = response.GetResponseStream())
                    using (StreamReader reader = new StreamReader(stream))
                    {
                        var result = reader.ReadToEnd();
                        return result;
                    }
                }                
            }

            return null;
        }

Basically, I've noticed the server associates some value with your session and awaits for that value to return in your subsequent post. That value is stored in the hidden input called fs_csrf and you have to post that along the other data and making sure the session id is also persisted in your request.