Java-登录到使用基于表单的身份验证的网站

Question

我试图登录到使用基于表单的身份验证的站点，以便我的应用程序可以进入，下载受保护的页面然后退出（是的，我有一个有效的用户名/密码组合）。

我知道：
1.登录页面的URL
2.登录身份验证器的URL
3.方法（帖子）
4.我的信息（显然）
5.用户名和密码字段（根据...而异。我已经写了一种获取名称的方法）。

目前，我正在此dream.in.code页上使用该代码作为我所做工作的基础。

每次我运行该应用程序时，它都会以“错误的用户名/密码”消息发送回登录页面。

码：

import java.net.*;
import java.util.LinkedList;
import java.io.*;

import javax.swing.JOptionPane;

public class ConnectToURL
{

  // Variables to hold the URL object and its connection to that URL.
  private static URL URLObj;
  private static URLConnection connect;
  private static String loginField;
  private static String passwordField;

  private static void getFields()
  {
    try
    {
      URLObj = new URL("http://url.goes.here/login.jsp");
      connect = URLObj.openConnection();
      // Now establish a buffered reader to read the URLConnection's input
      // stream.
      BufferedReader reader = new BufferedReader(new InputStreamReader(
          connect.getInputStream()));

      String lineRead = "";
      LinkedList<String> lines = new LinkedList<String>();

      // Read all available lines of data from the URL and print them to
      // screen.
      while ((lineRead = reader.readLine()) != null)
      {
        lines.add(lineRead);
      }
      reader.close();

      while(lines.peekFirst().indexOf("<th>Username or E-mail:</th>") == -1)
      {
        lines.removeFirst();
      }
      String usernameCell = "";
      while (usernameCell.indexOf("</td>") == -1)
      {
        usernameCell = usernameCell + lines.removeFirst().trim();
      }
      usernameCell = usernameCell.substring(usernameCell.indexOf("name=\"") + 6);
      usernameCell = usernameCell.substring(0, usernameCell.indexOf("\""));
      loginField = usernameCell;

      while(lines.peekFirst().indexOf("<th>Password:</th>") == -1)
      {
        lines.removeFirst();
      }

      String passwordCell = "";
      while (passwordCell.indexOf("</td>") == -1)
      {
        passwordCell = passwordCell + lines.removeFirst().trim();
      }
      passwordCell = passwordCell.substring(passwordCell.indexOf("name=\"") + 6);
      passwordCell = passwordCell.substring(0, passwordCell.indexOf("\""));
      passwordField = passwordCell;
    }
    catch (MalformedURLException e)
    {
      // TODO Auto-generated catch block
      e.printStackTrace();
    }
    catch (IOException e)
    {
      // TODO Auto-generated catch block
      e.printStackTrace();
    }
  }

  public static void main(String[] args)
  {
    try
    {
      // getFields() grabs the names of the username and password fields and stores them into variables above
      getFields();
      // Establish a URL and open a connection to it. Set it to output
      // mode.
      URLObj = new URL("http://url.goes.here/login_submit.jsp");
      connect = URLObj.openConnection();
      HttpURLConnection.setFollowRedirects(true);
      connect.setDoOutput(true);
    }
    catch (MalformedURLException ex)
    {
      System.out
          .println("The URL specified was unable to be parsed or uses an invalid protocol. Please try again.");
      System.exit(1);
    }
    catch (Exception ex)
    {
      System.out.println("An exception occurred. " + ex.getMessage());
      System.exit(1);
    }

    try
    {
      // Create a buffered writer to the URLConnection's output stream and
      // write our forms parameters.
      BufferedWriter writer = new BufferedWriter(new OutputStreamWriter(
          connect.getOutputStream()));
      // For obvious reasons, login info is editted.
      // The line begins with username=& because there's a username field that send no data and is set to display:none.
      // When I observed the request in Chrome, username was sent, but left blank. Without it, my request doesn't go through.
      writer.write("username=&" + loginField + "=" + URLEncoder.encode("Username", "UTF-8") + "&" + passwordField + "=" + URLEncoder.encode("myPassword", "UTF-8"));
      writer.close();

      // Now establish a buffered reader to read the URLConnection's input
      // stream.
      BufferedReader reader = new BufferedReader(new InputStreamReader(
          connect.getInputStream()));

      String lineRead = "";

      // Read all available lines of data from the URL and print them to
      // screen.
      while ((lineRead = reader.readLine()) != null)
      {
        System.out.println(lineRead);
      }

      reader.close();
    }
    catch (Exception ex)
    {
      System.out.println("There was an error reading or writing to the URL: "
          + ex.getMessage());
    }
  }
}

Answer 1

我会尝试使用诸如HttpFox或Fiddler之类的东西来查看登录过程中发送的确切内容，并尝试进行模拟。 有时登录页面会对Javascript发送的内容进行按摩。

Answer 2

使用LiveHTTPHeaders可以检查发布的所有内容。 您可能没有传递给POST命令的cookie /会话数据。

另外，有时还会对引荐来源网址进行监控，并且还应通过传递标头“ Referrer： http：//homepage.com.../login.html ”来伪造该网址。

Answer 3

您是否尝试过使用Appache httpClient（http://hc.apache.org/httpcomponents-client-ga/）而不是在解析html并插入值的地方编写自己的代码？

我相信，您不必解析html。 你的步骤应该是

• 查看html，看看您的身份验证请求要转到哪个“ url”
• 打开您找到的URL的连接，而不是发送到“登录页面”并对其进行解析以进行查找。
• httpclient类可以帮助您管理会话以使会话保持活动状态。 您可以自己做，但是会做很多工作