How can I diagnose the difference between a PHP curl POST and a C# WebClient POST?

Question

I have PHP code such as the following:

$url = "http://my.parkpay.co.za/includes/api.php"; # URL to WHMCS API file goes here
$postfields["username"] = $username;
$postfields["password"] = md5($password);
$postfields["accesskey"] = "4a588e76-4e1c-4240-baad-4d2d6e3433cf";
$postfields["responsetype"] = "json";
$postfields["action"] = "addbillableitem";
$postfields["clientid"] = "3";
$postfields["description"] = "Test From PHP Code";
$postfields["amount"] = "250.00";
$postfields["invoiceaction"] = "nextinvoice";

foreach ($postfields AS $k=>$v) $query_string .= "$k=".urlencode($v)."&";

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $query_string);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
$jsondata = curl_exec($ch);
if (curl_error($ch)) {
    die("Connection Error: ".curl_errno($ch).' - '.curl_error($ch));
}
curl_close($ch);

And C# code like this:

public string PostTestBillableItem()
{
    const string username = "{username}";
    var passwordHash = Md5Hash({passwordHash});
    var formFields = new[]
                            {
                                new KeyValuePair<string, string>("username", username),
                                new KeyValuePair<string, string>("password", passwordHash),
                                new KeyValuePair<string, string>("accesskey", "4a588e76-4e1c-4240-baad-4d2d6e3433cf"),
                                new KeyValuePair<string, string>("responsetype", "json"),
                                new KeyValuePair<string, string>("action", "addbillableitem"),
                                new KeyValuePair<string, string>("clientid", "3"),
                                new KeyValuePair<string, string>("description", "Payment Towards Web Design Project"),
                                new KeyValuePair<string, string>("amount", "250.00"),
                                new KeyValuePair<string, string>("invoiceaction", "nextinvoice")
                            };
    var postData = formFields.Aggregate("", (current, pair) => current + (pair.Key + "=" + HttpUtility.UrlEncode(pair.Value) + "&"));
    var client = new WebClient();
    var result = client.UploadString("http://my.parkpay.co.za/includes/api.php", postData);
    return result;
}

When I execute the PHP code, on IIS 7.5, I get a successful response. When I execute my seemingly identical C# code, I get blocked because of my IP address. My use of the `accesskey" value is supposed to prevent the IP address check. It does with the PHP code, not with the C# code.

What tools can I use to examine the leaving request HTTP? The form data posted in each case is identical, including the password hash, so I guess I'm looking for a header or encoding difference in the messages.

Answer 1

According to the functions you have pasted, post data is not identical. Not by a long shot.

You have different accesskeys and a alot more parameters in the C# code, what happens if you run it again with the same parameters?

Answer 2

1. I'm not ac# user but the Aggregate function would return a string with "&" at the end which might cause a problem.

2. you can check the return value of urlencode function whether php and c# use the same rfc encoding

3. if these are not the case then you can use wireshark to analyze the packet.

Answer 3

I think I used Fiddler, not Wireshark, I can't recall, but the difference was that cURL implicitly added two headers that WebClient didn't. The following additions solved the problem:

var client = new WebClient();
client.Headers.Add("Accept", "/");
client.Headers.Add("Content-Type", "application/x-www-form-urlencoded");