Goal
My goal is to replay a set of ASP.NET Forms Authentication session cookies through a phantomjs script.
What I've tried
My phantomjs script is below. The script works if I replay the cookies to the website hosted in my local VS2010 ASP.NET Development Server. However, if I try the same code on the website hosted on IIS6, the replay fails.
The replay appears to work fine when the code is running on IIS7
Note: I do realize that the authentication cookies are different for the two different sessions (IIS and ASP.NET Development Server), and I am using the correct cookies for each session.
Suspicions
I suspect that there is either:
- a problem with the value I am using for the cookie's domain
- a difference between how IIS6 and VS handle authentication cookies, maybe IIS6 won't accept a replay from a different IP?
Script
var page = require('webpage').create();
var tests = {
'localhost': {
url: 'http://localhost/Test.aspx',
cookies:
[{
"name":"ASP.NET_SessionId"
,"value":"abcdefghijk"
,"domain":'localhost'
},{
"name":".ASPXFORMSAUTH"
,"value":"2D23D9EFF2F538..."
,"domain":'localhost'
}]
},
'www.myserver.com': {
url: 'http://www.myserver.com/Test.aspx',
cookies:
[{
"name":"ASP.NET_SessionId"
,"value":"lmnopqrstuv"
,"domain":'www.myserver.com'
},{
"name":".ASPXFORMSAUTH"
,"value":"9EFF2F53823BDA..."
,"domain":'www.myserver.com'
}]
}
};
// uncomment the test you want to perform
var test = tests['localhost'];
// var test = tests['www.myserver.com'];
phantom.addCookie(test.cookies[0]);
phantom.addCookie(test.cookies[1]);
page.open(test.url, function (status) {
if (status !== 'success') {
console.log('Unable to access network');
} else {
console.log(page.content);
}
phantom.exit();
});
Work-around:
Since the issue only occurs in my development environment: As a work-around, I created a web service that would return a session and authentication cookie. Then open that service from my PhantomJS script so that the cookie would be added to the current PhantomJS context. Then I would open the real url that I was targeting. Handing our authentication cookies without actually authenticating the user is a bit of a security hole, so I wrap it in compiler directives so that it's not available in the production build.
C#
HttpContext.Current.Response.Cookies.Add(FormsAuthentication.GetAuthCookie(username, true, "/"));
js:
page.open(authUrl, function (status) {
page.open(address, function (status) {
});
});