CODEWITHSUNDEEP
javascriptphpformsauthenticationhttps
mmseng
mmseng

Reputation: 850

Automatically submitting form to HTTPS site, how to authenticate?

I'm hacking together a script to automate the submission of tickets to our helpdesk system. So far it's a very simple, but working system. I have a page with a form that auto-submits via JavaScript with form value based on the URL requested.

This works great when you access the page from your browser. Assuming you're already authenticated to the ticket system page, the auto-submitted form happily sends its form data and you are directed to the ticket list where you see the newly auto-submitted ticket. Unfortunately of course, the ticket system is an HTTPS secured site, so if you're not logged in you're directed to the login page and the auto-submission fails.

The idea however is to run this auto-submission on a schedule, or kick it off remotely, where the initiator won't necessarily be human and won't be following the form submission to babysit it with delicious authentication cookies.

So, being a newbie in this area, my options seem to be A) dive in and get real messy by listening for the auto-submission response, determine whether the login page is being returned and submit some credentials via JS (not a huge deal as this automation would run solely on a secured server), then resubmit the form... or B) somehow do this the proper way by authenticating beforehand. But that's where my knowledge ends.

I've read through this similar question, but am still coming up short. Is this proper automation only possible if the server in question supports some form of auth token API? Is there not a more direct way to connect and request/submit data to an HTTPS site? I've been glossing over some introductions to cURL, but have not yet dove in.

NB: I don't have direct access to the ticket database, code, nor to the web server processes/accounts running it. I probably can run processes on the same machine, which is why I'm not real concerned with the security of auto-submitting credentials, but that's probably it.

Upvotes: 0

Views: 697

Answers (1)

Keiji
Keiji

Reputation: 1042

Firstly, whether your ticket system directs you to a login screen if you're not already authenticated has nothing to do with HTTPS - this will be either a username/password <form> that then sets a cookie, or it will be a WWW-Authenticate header. Each of these can be used whether you are using HTTPS or plain HTTP.

Whichever method it uses, if you're planning on doing this in a web browser, chances are you won't be able to because CORS (cross-origin resource sharing) will probably not have been set up to allow it.

If however you're doing this from a script such as Node.js, Python, PHP or anything else that can make arbitrary HTTP(S) requests, you might want to look at a flow like this:

  1. Request the index page of the ticket system
  2. Detect whether it gave you a login screen
  3. If so, fetch any necessary data from the login screen (e.g. a nonce) and make a POST request as if you filled in the username/password yourself
  4. Check that authentication was successful (based on the POST response)
  5. Keep the cookie returned by your POST request and use it to submit the ticket.

For the simpler case where the system uses a WWW-Authenticate header it would be like this:

  1. Request the index page of the ticket system
  2. Detect the WWW-Authenticate header in the HTTP 401 response received
  3. Send an Authorization header with an appropriate value
  4. Check that authentication was successful (based on getting an HTTP 200 instead of a HTTP 401)
  5. Send the same Authorization header again while submitting the ticket.

Using WWW-Authenticate is described at Wikipedia for basic and digest authentication.

Upvotes: 2

Related Questions