C# post requests not identified as session

Question

I've been trying to have a WPF client connecting to a PHP server, logging itself in and fetching 'IsLogged.php' to validate that the client is logged in. However, 'IsLogged.php' always returns that the client isn't authenticated, what am I doing wrong?

Servercode:

"CreateAccount.php"

session_start();

if (isset($_POST['user']))
{
    $_SESSION['UserName'] = $_POST['user'];
    echo "check";
}

"IsLogged.php"

session_start();

if (isset($_SESSION['UserName']))
{
    echo "allowed";
}
else
{
    echo "not allowed";
}

Client code:

"Post" method

    public static string Post(string RequestName, string PostData, out HttpStatusCode ReturnCode)
    {
        byte[] byteArray = Encoding.UTF8.GetBytes(PostData);

        WebRequest Request = WebRequest.Create(ChatAPI.Settings.BaseUrl + RequestName);
        Request.Method = "POST";
        Request.ContentType = "application/x-www-form-urlencoded";
        Request.ContentLength = byteArray.Length;

        Stream dataStream = Request.GetRequestStream();
        dataStream.Write(byteArray, 0, byteArray.Length);
        dataStream.Close();

        WebResponse response = Request.GetResponse();
        dataStream = response.GetResponseStream();

        ReturnCode = ((HttpWebResponse)response).StatusCode;

        StreamReader reader = new StreamReader(dataStream);
        string returnedData = reader.ReadToEnd();

        reader.Close();
        dataStream.Close();
        response.Close();

        return returnedData;
    }

And finally the window triggering the POST requests.

        HttpStatusCode Code;
        MessageBox.Show(General.Post("IsLogged", "", out Code)); --> Not allowed (intended)
        MessageBox.Show(General.Post("CreateAccount", "user=jan", out Code)); --> check (intended)
        MessageBox.Show(General.Post("IsLogged", "", out Code)); --> Not allowed (should be allowed)

Why is the server not registering the requests as a session?

Answer 1

The way the server identifies the client (and the corresponding session state) is through cookies.

Basically, in the CreateAccount request, the server attaches a cookie to its response and expects the client to present the cookie on every subsequent request.

If the cookie is not present in a request, the server has no way of identifying the client and treats the request as coming from an unknown source.

Your code does not manage cookies at all, so this is why the C# client always appears to be a new client to the PHP server.

The easiest way to save the cookie received from the server and present it on every new request is to use an instance of CookieContainer and attach it to every request you make .

I didn't try this code, so I'm not 100% sure of the syntax, but here's a starting point:

// this instance will be reused across multiple requests
private static CookieContainer cookieContainer = new CookieContainer();

public static string Post(string RequestName, string PostData, out HttpStatusCode ReturnCode)
{
    byte[] byteArray = Encoding.UTF8.GetBytes(PostData);

    WebRequest Request = WebRequest.Create(ChatAPI.Settings.BaseUrl + RequestName);
    Request.Method = "POST";
    Request.ContentType = "application/x-www-form-urlencoded";
    Request.ContentLength = byteArray.Length;

    Request.CookieContainer = cookieContainer; // this line is new

    Stream dataStream = Request.GetRequestStream();
    dataStream.Write(byteArray, 0, byteArray.Length);
    dataStream.Close();

    WebResponse response = Request.GetResponse();
    dataStream = response.GetResponseStream();

    ReturnCode = ((HttpWebResponse)response).StatusCode;

    StreamReader reader = new StreamReader(dataStream);
    string returnedData = reader.ReadToEnd();

    reader.Close();
    dataStream.Close();
    response.Close();

    return returnedData;
}