C#：即使在使用http客户端发送CSRF令牌后也能得到403

Question

我试图发布一个有效载荷到我们的后端系统从我的UWP应用程序。为此，我首先做一个GET来获取CSRF令牌，然后将其添加到POST请求的标题中。虽然发布，我仍然得到403禁止错误。

我正在用“失眠症”REST客户端进行交叉测试，通过执行单独的GET和POST请求，并将从GET获取的CSRF令牌提供给POST头，它工作正常。

我是新来的C#，所以请原谅不好的编码标准。

拿到代币

    public async Task<string> GetCSRF()
    {
        using (HttpClient httpClient = new HttpClient())
        {
            httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(
                                                                                                                    System.Text.Encoding.ASCII.GetBytes(
                                                                                                                            string.Format("{0}:{1}", userName.Text.ToUpper(), SAPpassword.Password))));
            httpClient.DefaultRequestHeaders.Add("X-CSRF-TOKEN", "fetch");
            HttpResponseMessage response = await httpClient.GetAsync(new Uri(_URI));
            response.EnsureSuccessStatusCode();
            if (response.Content == null)
                return null;
            String csrfToken = response.Headers.GetValues("X-CSRF-TOKEN").FirstOrDefault();
            return csrfToken;
        }
    }

我收到了带有csrf令牌的以下标头

• 答复。标题{x-csrf-token:w1Id2Kn1r0d6EItk6vEi0g==缓存控制：无存储，无缓存sap元数据上次修改时间：2017年9月1日星期五10:57:07 GMT数据服务版本：2.0集cookie:sap usercontext=sap client=100；path=/，MySapss2=AJQXMDMBabHtafMarqOecaQaQaQaGaaCaiaAyayXaDaaQaQaQaQaGaaGaaAaAyaQaAaAyaYmaBaaQaQaBaaQaQaQaQaAaQaQaGaaAaAaAaAaQaAaQaAaQaACQACRQD/APSWGFGCSQGSIB3DQEHACB6JCB5WIBATELMAKWYJKOZHVCNAQCBMYHMHIAGEBBKWDJEMMAOGA1EAXMDR1CAXAGGFAMOABMAKQHKIG9W0BCQMXCWYJKOZHVCNAQCBMBWGCSQIB3DQEJBTEPFW0NZA5MDEYMDQ8ST9P53T9SFU58STKJJKKKKKKKQDBC8W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W7W==; 路径=/；域=。mindsetconsulting。com，SAP_SESSIONID_GW1_100=u1BKLug0BNWYM0-zg_JWTBEihxmPVxHnvTMKDkBCwEk=；path=/access control allow credentials:true access control allow标头:*access control allow origin:*。谷歌。com访问控制允许方法：}系统。网Http。标题。httpresponses负责人

用令牌发送有效载荷

        public async Task<string> SendChannelToSAP(UserStorage userStorage, string csrf)
    {
        string payloadJson;
        string jsonResponse;
        HttpResponseMessage response;
        HttpContent content;

        using (var client = new HttpClient())
        {
            client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
                                                            "Basic", Convert.ToBase64String(
                                                                System.Text.Encoding.ASCII.GetBytes(
                                                                     string.Format("{0}:{1}", userName.Text.ToUpper(), SAPpassword.Password))));


            payloadJson = JsonConvert.SerializeObject(userStorage);
            content     = new StringContent(payloadJson);
            content.Headers.ContentType = new MediaTypeHeaderValue("application/json");
            client.DefaultRequestHeaders.Add("x-csrf-token", csrf);
            try
            {
                response = await client.PostAsync(_URI, content);
                if (response.IsSuccessStatusCode)
                {
                    jsonResponse = await response.Content.ReadAsStringAsync();
                    return jsonResponse;
                    //do something with json response here                    
                }
                else
                {
                    return null;
                }

            }
            catch (Exception e)
            {
                string error = e.GetBaseException().ToString();
                //Could not connect to server
                return null;
            }
        }
    }

我得到以下回应

• 响应{StatusCode:403，ReasonPhrase:'禁止'，版本：1.1，内容：System.Net.Http.StreamContent，标题：{x-csrf-token:Required set cookie:sap usercontext=sap client=100；path=/set cookie:MYSAPSSO2=AJQXMDMBabHtafMarqboaeCavacQaQaQaQaQaQaGaaCaiaAyxadaamadababaaQaQaQaQaQaQaQaQaQaQaQaQaQaGaaCaaAaQaAaQaQaAaAaQaQaQaAaQaAaQaQaQaQaQaQaAaQaQaQaQaQaQaQaQaQaQaQaQaQaAaQaQaQaAaAaAaAaAaOimambmakgbssoawaiabaqcgxtaybgkqhkig9w0bcqmxcwyjkozihvcnaqcbmbwgcsqgsib3dqejbtepw0xnza5mdeym4mtbamcmgcsqgsib3dqejbdewbbrsjqhrlpcsnxyjzsrqj/rOgo/g2tajbgbgcqhjjooaqdbc8wlqiuxjws4bw63uldwr！NB9r9XUCD54CFQCH6y91A！uKMzyfZEo7pvxjXys6zg==；路径=/；域=。mindsetconsulting。com set cookie:SAP_SESSIONID_GW1_100=Zvfe5ueHO1md7_ybPcLEcnem3m6PVRHnvP4KDkBCwEk=；path=/access control allow credentials:true access control allow标头:*access control allow origin:*。谷歌。com访问控制允许方法：*内容长度：28内容类型：文本/普通；charset=utf-8}系统。网Http。HttpResponseMessage

Answer 1

我发现了问题。我必须收集cookie和csrf令牌，并在实际的POST方法中应用这些cookie。那起作用了。

拿到饼干后再拿

                    Uri uri = new Uri(_URI);
                    _responseCookies = cookies.GetCookies(uri).Cast<Cookie>();

然后把饼干加到帖子里

        CookieContainer cookieContainer = new CookieContainer();
        foreach (var cookie in _responseCookies)
        {
            cookieContainer.Add(new Uri(_URI), cookie);
        }
HttpClientHandler handler = new HttpClientHandler() { CookieContainer = cookieContainer };