replay forms authentication session cookies to ASP.NET via phantomjs

Viewed 1121

Goal

My goal is to replay a set of ASP.NET Forms Authentication session cookies through a phantomjs script.

What I've tried

My phantomjs script is below. The script works if I replay the cookies to the website hosted in my local VS2010 ASP.NET Development Server. However, if I try the same code on the website hosted on IIS6, the replay fails.

The replay appears to work fine when the code is running on IIS7

Note: I do realize that the authentication cookies are different for the two different sessions (IIS and ASP.NET Development Server), and I am using the correct cookies for each session.

Suspicions

I suspect that there is either:

  • a problem with the value I am using for the cookie's domain
  • a difference between how IIS6 and VS handle authentication cookies, maybe IIS6 won't accept a replay from a different IP?

Script

var page = require('webpage').create();  

var tests = {
    'localhost': {
        url: 'http://localhost/Test.aspx',
        cookies: 
            [{
                "name":"ASP.NET_SessionId"
                ,"value":"abcdefghijk"
                ,"domain":'localhost'
            },{
                "name":".ASPXFORMSAUTH"
                ,"value":"2D23D9EFF2F538..."
                ,"domain":'localhost'
            }]
    },
    'www.myserver.com': {
        url: 'http://www.myserver.com/Test.aspx',
        cookies: 
            [{
                "name":"ASP.NET_SessionId"
                ,"value":"lmnopqrstuv"
                ,"domain":'www.myserver.com'
            },{
                "name":".ASPXFORMSAUTH"
                ,"value":"9EFF2F53823BDA..."
                ,"domain":'www.myserver.com'
            }]      
    }   
};

// uncomment the test you want to perform
var test = tests['localhost'];
// var test = tests['www.myserver.com'];

phantom.addCookie(test.cookies[0]);
phantom.addCookie(test.cookies[1]);

page.open(test.url, function (status) {
    if (status !== 'success') {
        console.log('Unable to access network');
    } else {        
        console.log(page.content);
    }
    phantom.exit();
});

Work-around:

Since the issue only occurs in my development environment: As a work-around, I created a web service that would return a session and authentication cookie. Then open that service from my PhantomJS script so that the cookie would be added to the current PhantomJS context. Then I would open the real url that I was targeting. Handing our authentication cookies without actually authenticating the user is a bit of a security hole, so I wrap it in compiler directives so that it's not available in the production build.

C#

HttpContext.Current.Response.Cookies.Add(FormsAuthentication.GetAuthCookie(username, true, "/"));

js:

page.open(authUrl, function (status) {
    page.open(address, function (status) {
    });
});
1 Answers
Related