为什么我不能使用HttpClient登录这个ASP.NET网站？

Question

有一个来自第三方的ASP.NET网站，需要一个人登录。我需要从网站上获取一些数据并解析它，所以我想我会使用HttpClient将必要的凭据发布到网站上，就像浏览器一样。然后，在那个POST请求之后，我想我能够使用我收到的cookie值来向（仅限授权）URL发出进一步的请求。

我已经能够成功地将凭证发布到登录URL并接收三个cookie：ASP.NET_SessionId，.ASPXAUTH以及网站本身使用的自定义值，每个都有自己的值。我认为，由于我设置的HttpClient使用的是使用CookieContainer的HttpHandler，因此cookie会随着每个进一步的请求一起发送，我会保持登录状态。

但是，这似乎不起作用。如果我使用相同的HttpClient实例然后请求网站的一个安全区域，我只是再次获取登录表单。代码：

        const string loginUri = "https://some.website/login";

        var cookieContainer = new CookieContainer();
        var clientHandler = new HttpClientHandler() { CookieContainer = cookieContainer, AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate };
        var client = new HttpClient(clientHandler);
        client.DefaultRequestHeaders.Accept.Clear();
        client.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

        var loginRequest = new HttpRequestMessage(HttpMethod.Post, loginUri);

        // These form values correspond with the values posted by the browser
        var formContent = new FormUrlEncodedContent(new[]
        {
            new KeyValuePair<string, string>("customercode", "password"),
            new KeyValuePair<string, string>("customerid", "username"),
            new KeyValuePair<string, string>("HandleForm", "Login")
        });

        loginRequest.Content = formContent;

        loginRequest.Headers.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393");
        loginRequest.Headers.Referrer = new Uri("https://some.website/Login?ReturnUrl=%2f");
        loginRequest.Headers.Host = "some.website";
        loginRequest.Headers.Connection.Add("Keep-Alive");
        loginRequest.Headers.CacheControl = new System.Net.Http.Headers.CacheControlHeaderValue() { NoCache = true };
        loginRequest.Headers.AcceptLanguage.ParseAdd("nl-NL");
        loginRequest.Headers.AcceptEncoding.ParseAdd("gzip, deflate");
        loginRequest.Headers.Accept.ParseAdd("text/html, application/xhtml+xml, image/jxr, */*");

        var response = await client.SendAsync(loginRequest);
        var responseString = await response.Content.ReadAsStringAsync();

        var cookies = cookieContainer.GetCookies(new Uri(loginUri));

使用正确的凭据时，cookie包含三个项目，包括.ASPXAUTH cookie和会话ID，这表明登录成功。然而：

        var text = await client.GetStringAsync("https://some.website/secureaction");

...这只是再次返回登录表单，而不是我使用浏览器登录并导航到/ secureaction时获得的内容。

我错过了什么？

编辑：这是我的应用程序正在完成的请求和请求chrome正在制作。它们是相同的，除了cookie值。我把它们穿过windiff：标有<！的线条！是我的应用程序发送的行，标记为！>的行是由Chrome发送的。

GET https://some.website/secureaction 
Connection: keep-alive  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36  
Accept-Encoding: gzip, deflate, sdch, br 
Upgrade-Insecure-Requests: 1  
Host: some.website  
Accept-Language:nl-NL, 
>> nl;q=0.8,en-US;q=0.6,en;q=0.4

Accept: text/html, 
>> application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Cookie: 
<!      customCookie=7CF190C0; 
<!          .ASPXAUTH=37D61E47(shortened for readability); 
<!      ASP.NET_SessionId=oqwmfwahpvf0qzpiextx0wtb 
!>      ASP.NET_SessionId=kn4t4rmeu2lfrgozjjga0z2j;          
!>          customCookie=8D43E263; 
!>          .ASPXAUTH=C2477BA1(shortened for readability)

HttpClient应用程序获得302引用/ login，Chrome获得包含所请求页面的200响应。

Answer 1

根据要求，这是我最终如何运作的方式。我必须首先对/ login执行简单的GET请求，然后使用登录凭据执行POST。我不记得GET正确设置了什么值（我假设一个cookie具有服务器想要的某些编码值），但是无论如何HttpClient都会处理cookie，所以它才有效。这是最终的工作代码：

    const string loginUri = "https://some.website/login";

    var cookieContainer = new CookieContainer();
    var clientHandler = new HttpClientHandler() 
    { 
        CookieContainer = cookieContainer, 
        AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate 
    };

    var client = new HttpClient(clientHandler);
    client.DefaultRequestHeaders.Accept.Clear();
    client.DefaultRequestHeaders.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));

    // First do a GET to the login page, allowing the server to set certain 
    // required cookie values.
    var initialGetRequest = new HttpRequestMessage(HttpMethod.GET, loginUri);
    await client.SendAsync(initialGetRequest);

    var loginRequest = new HttpRequestMessage(HttpMethod.Post, loginUri);

    // These form values correspond with the values posted by the browser
    var formContent = new FormUrlEncodedContent(new[]
    {
        new KeyValuePair<string, string>("customercode", "password"),
        new KeyValuePair<string, string>("customerid", "username"),
        new KeyValuePair<string, string>("HandleForm", "Login")
    });

    loginRequest.Content = formContent;

    loginRequest.Headers.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393");
    loginRequest.Headers.Referrer = new Uri("https://some.website/Login?ReturnUrl=%2f");
    loginRequest.Headers.Host = "some.website";
    loginRequest.Headers.Connection.Add("Keep-Alive");
    loginRequest.Headers.CacheControl = new System.Net.Http.Headers.CacheControlHeaderValue() { NoCache = true };
    loginRequest.Headers.AcceptLanguage.ParseAdd("nl-NL");
    loginRequest.Headers.AcceptEncoding.ParseAdd("gzip, deflate");
    loginRequest.Headers.Accept.ParseAdd("text/html, application/xhtml+xml, image/jxr, */*");

    var response = await client.SendAsync(loginRequest);
    var responseString = await response.Content.ReadAsStringAsync();

    var cookies = cookieContainer.GetCookies(new Uri(loginUri));