I am working on an ionic2 application that requires authentication to be done on an existing PHP website and then execute certain requests within it. I do not have access to the source code of the website. Since I am using ionic2, CORS should not be an issue, and I have manually turned it off in Chrome for testing purposes.
I have created a service that handles the login request to the page at data/login.php. However, I am facing an issue where the login always fails and the _body remains empty.
Additionally, I am unsure how to retrieve and store the session cookie that is set to maintain the session.
Below is the relevant code snippet from the login service:
doLogin(username, password) {
var headers = new Headers();
headers.append('content-type', 'application/x-www-form-urlencoded')
var params = new URLSearchParams();
params.append('usr', username);
params.append('psw', password);
params.append('invia_annuario', 'Accedi');
this.http.post(this.loginPage, params.toString(), { headers: headers })
.subscribe(
data => {
console.log(data);
},
Error => { console.log(Error) },
() => { console.log("Done") }
);
}
Here is the structure of a real browser request:
Proper request:
POST /data/login.php HTTP/1.1
Host: [website]
Connection: keep-alive
Content-Length: 55
Cache-Control: max-age=0
Origin: [website]
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.33 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://www.lions.it/data/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Request data:
usr=[username]&psw=[password]&invia_annuario=AccediResponse:
HTTP/1.1 200 OK
Date: Wed, 15 Jun 2016 13:34:24 GMT
Server: Apache
X-Powered-By: PHP/5.5.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Refresh: 0; URL=./index.php
Set-Cookie: PHPSESSID=6qp5p3f8tm7bm3hqgttfqk20m1; path=/
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
My custom request looks like this:
POST /data/login.php HTTP/1.1
Host: [website]
Connection: keep-alive
Content-Length: 55
Origin: http://localhost:8100
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.33 Safari/537.36
content-type: application/x-www-form-urlencoded
Accept: */*
Referer: http://localhost:8100/?ionicplatform=android
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: PHPSESSID=ua37v7sgojddlnt2d961t5gu33; legatus_post_views_count_22=1
Response:
HTTP/1.1 200 OK
Date: Wed, 15 Jun 2016 13:28:11 GMT
Server: Apache
X-Powered-By: PHP/5.5.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Refresh: 0; URL=./index.php
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
How can I correctly send a request to the remote site and obtain the session cookie?