是否可以在服务器端对外部 HTTPS url 执行 POST 并将用户重定向到 POST 目的地？

Question

So I can do the following POST submit

@Html.BeginForm(null, null, FormMethod.Post, new { @action = "https://externalsite.com/secretroom" })
    {
        <input id="SECRETCODE" name="SECRETCODE" type="hidden" value="GABEN" />
        <input type="submit" value="submit"/>
    }

After the submit, it will took me to https://externalsite.com/secretroom . But as you can see the SECRETCODE is getting exposed in user HTML page and I don't want that.

So what I'm gonna do is I'm trying to do the POST on my server side.

public ActionResult Test()
    {
            using (var client = new HttpClient())
            {
                client.BaseAddress = new Uri("https://externalsite.com/secretroom");
                var content = new FormUrlEncodedContent(new[] 
                {
                    new KeyValuePair<string, string>("SECRETCODE", "GABEN")
                });
                var result = await client.PostAsync("", content).Result;
                if(result.IsSuccessStatusCode)
                {
                    return Redirect("https://externalsite.com/secretroom");
                }
            }
    }

The problem is I can't redirect the user because the externalsite will deny it and I have no idea/no control over how the secretroom validation works on externalsite . It will only allow access if I did it the way I did above.

That being said, is this actually possible?

Answer 1

Edit : After getting a little more clarity on exactly what you're trying to accomplish, I don't believe you can do that. Specifically because in your first example, you're actually sending a response to the users browser which is redirecting them to the target site and sending along the form parameters for the ride. Whereas, programmatically POSTing the data is out-of-band of the browser. The two approaches aren't interchangeable. You'll most likely need to work with the site provider to identify an alternative method if you're not satisfied sending sensitive data this way.

Original Solution

You can use the WebRequest class to programmatically POST the data over.

WebRequest request = WebRequest.Create("https://externalsite.com/secretroom");
request.Method = "POST";
... rest omitted - refer to link below for specifics ...

https://msdn.microsoft.com/en-us/library/debx8sh9%28v=vs.110%29.aspx

Also, you may want to refer to the following SO question for details on the variants of the WebRequest classes ie HttpWebRequest, FtpWebRequest, etc.

C# HttpWebRequest vs WebRequest