which cookies/headers should I set?

Question

I should get a protected page from external site, if I call it directly, I get an error:

Bad Request

Postman:

But if I call a login page with valid credentials via Postman:

and then recall THE SAME resource page from the same Postman I got the protected page!:

I have to get the same page on website. I try to implement it by the following way:

            var loginXml = "<Request><MsgType>Authenticate</MsgType><SubMsgType>Login</SubMsgType><UserID>my_login</UserID><passwordNotEncrypted>my_password</passwordNotEncrypted></Request>";
            $.ajax(
                {
                    url: 'https://address/browserservices.aspx/login',
                    type: 'POST',
                    contentType: 'text/xml',
                    datatype: 'text',
                    //xhrFields: {
                    //    withCredentials: true
                    //},
                    //crossDomain: true,
                    data: loginXml,
                    success: function (output, status, xhr) {
                        alert(xhr.getResponseHeader("Set-Cookie"));
                        $.ajax({
                            url: "https://address/RemoteSupport.aspx?id=GUID&pltFrmType=Android&agentversion=13.46",
                            type: 'GET',
                            xhrFields: { withCredentials: true },
                            //crossDomain: true,
                            success: function (x) { },
                            error: function (xhr, textStatus) { alert(xhr.status); }
                        });
                    },
                })

but I get Bad Request again. Which headers/cookies should I pass to page to open protected page, like it's in Postman?

ADDED 28/01/19 Postman "Cookie" tab after success login request (fail login request has the same):

and "Headers" tab:

as I see, all access-control-allow header are available. What should I pass via ajax?

Postman is likley storing something in the session which allows you to log on. Usually to authenticate with an application you'd hit an end point and be returned something like a token which can be sent with the next request — MikeS, Jan 25 '19 at 16:37
You need to provide more info. Like for example where you are running it... Because if you are trying to run it on a normal browser, it will most likely fail since cross domain requests will return an error in most cases. — GramThanos, Jan 27 '19 at 00:38
@GramThanos I don't have more info. It works with Postman, but I can't do it for web — Oleg Sh, Jan 27 '19 at 17:47
Check if Postman is saving any Cookie. Probably, after login you are getting some cookie that Postman store it for you. If this is happening, you should implement this flow on your code. — gatsby, Jan 28 '19 at 08:31
What is the value for the `alert(xhr.GetResponseHeader("Set-Cookie")`? — ste-fu, Jan 28 '19 at 15:48
@ste-fu `xhr.getResponseHeader("Set-Cookie")` responses `null` — Oleg Sh, Jan 28 '19 at 21:02

ste-fu · Accepted Answer · 2019-01-28T23:54:59.807

Based on the information that you have supplied there are two likely scenarios.

Firstly, the cookie that is set by the external site is HttpOnly. This is easy enough to check in Postman, by clicking on the the Cookies tab.

The second option is a little more complex, but the external server has to set the Access Control headers correctly. Again there is a Headers tab to view these. More info on cross domain ajax and headers in this question: Why is jquery's .ajax() method not sending my session cookie?

Finally worth noting, your browser will automatically add a header to indicate that it is an ajax request. You could try adding the X-Requested-With: XMLHttpRequest header in Postman and seeing how it differs from your examples. The external server may well be configured to respond differently to ajax requests than to browser or server-server api requests.

Update Your Postman update shows that both of those scenarios are true. Unfortunately this means that you cannot achieve your desired result with JavaScript. HttpOnly = true means that the browser will never allow the script on your page to access the cookie.

At this point your best bet is probably to write a little proxy method on your own site that makes the request server to server and then returns the result to your JavaScript code. This should bypass all the above issues albeit you need to make 2 requests instead of 1 for the data.

Take a look at this answer for some code

Struggling trying to get cookie out of response with HttpClient in .net 4.5

I added `headers: {"X-Requested-With": "XMLHttpRequest"}` to ajax call, nothing changed — Oleg Sh, Jan 28 '19 at 21:25
Thank you, it helped me! Right now I need to solve next problem, linked with it. Could you look at it? https://stackoverflow.com/questions/54412534/how-to-open-page-in-browser-with-cookie — Oleg Sh, Jan 29 '19 at 01:14

which cookies/headers should I set?

1 Answers1