Re: Secure website login tutorials?

Le mercredi 17 août 2005 à 06:44, Peter Scott écrivait:
> On Mon, 15 Aug 2005 13:40:19 -0700, Johnc wrote:
> > Hi,  I'm trying to write a bot to login to the scottrade trading site, 
> > and while I'm taking care to grok hidden fields
> > and I've initalized a cookie jar for my LWP agent, posting the login 
> > info to the form still just returns the login form
> > again (no error message).
> 
> Use WWW::Mechanize and you won't have to grok hidden fields or cookies.

The ->click vs ->submit issue mentionned before is an important
trick. click() sends back a form parameter with the name of the button,
while submit() doesn't. Apparently, some sites expect to receive this
field too.

> > Are there any tutorials out there that address common caveats for this 
> > sort of thing?  Or what else do I potentially
> > need to take care of to make sure my LWP agent is getting all of the 
> > necessary session data to log in?
> 
> The big danger is JavaScript.  I have found no alternative to looking at
> the source and analyzing the source by hand to see whether JavaScript
> might be modifying any form parameters.  However so far this hasn't taken
> me very long.

I've seen JavaScript used to add Cookies as well. The server doesn't
send any cookie, but the client send some back.

Since I do not like reading the JavaScript source, I use a simple
proxy based on HTTP::Proxy (found under eg/logger.pl in the HTTP::Proxy
distribution), which prints out interesting headers (Cookie, Location,
etc) and form fields. It's usually enough for finding out what the web
robot needs to send to the server.

-- 
 Philippe "BooK" Bruhat

 Everyone's life seems easier from the outside.
                                    (Moral from Groo The Wanderer #45 (Epic))