如何用C# Application通过HTTP POST登录网站并获取登录后专属数据？

Absolutely, you can absolutely pull this off with a C# app—great call using Chrome’s Network DevTools to figure out the POST login flow, that’s half the battle already! Let’s walk through exactly how to make this work.

1. Capture All Required Login Parameters #

First, double-check the POST request details from Chrome’s Network tab:

• Go to the Form Data section of the login request—you’ll see all fields the site expects (not just username/password). This often includes things like __RequestVerificationToken (a CSRF token) or other hidden form fields.
• Make a note of every key-value pair here—you’ll need to include all of them in your C# POST request, otherwise the site will reject your login attempt.

2. Use HttpClient with CookieContainer (Cookie-Based Auth) #

Most websites use cookies to persist login sessions. The CookieContainer class lets HttpClient automatically store and reuse these cookies across requests. Here’s a working example:

using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Collections.Generic;
using System.Threading.Tasks;
// Add HtmlAgilityPack via NuGet to parse hidden form fields easily
using HtmlAgilityPack;

class Program
{
    static async Task Main(string[] args)
    {
        // Initialize HttpClient with a CookieContainer to persist session cookies
        var cookieContainer = new CookieContainer();
        var handler = new HttpClientHandler { CookieContainer = cookieContainer };
        using var client = new HttpClient(handler);

        // Set a realistic User-Agent (many sites block default HttpClient user agents)
        client.DefaultRequestHeaders.UserAgent.ParseAdd("Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36");

        // Step 1: Fetch the login page to extract hidden fields (like CSRF token)
        var loginPageUrl = "https://example.com/login";
        var loginPageResponse = await client.GetAsync(loginPageUrl);
        loginPageResponse.EnsureSuccessStatusCode();
        var loginPageHtml = await loginPageResponse.Content.ReadAsStringAsync();

        // Parse HTML to get the CSRF token (adjust the XPath to match your site's field)
        var htmlDoc = new HtmlDocument();
        htmlDoc.LoadHtml(loginPageHtml);
        var csrfToken = htmlDoc.DocumentNode.SelectSingleNode("//input[@name='__RequestVerificationToken']")?.Attributes["value"].Value;

        // Step 2: Prepare the POST form data (include ALL fields from Chrome's Form Data)
        var formData = new Dictionary<string, string>
        {
            { "Username", "your-actual-username" },
            { "Password", "your-actual-password" },
            { "__RequestVerificationToken", csrfToken }
            // Add any other fields you saw in Chrome (e.g., "ReturnUrl", "RememberMe")
        };

        var postContent = new FormUrlEncodedContent(formData);
        var loginResponse = await client.PostAsync(loginPageUrl, postContent);
        
        // Verify login succeeded (check status code, or redirect to a logged-in page)
        loginResponse.EnsureSuccessStatusCode();

        // Step 3: Access protected data—HttpClient automatically uses the saved cookies
        var protectedDataUrl = "https://example.com/protected/user-data";
        var protectedDataResponse = await client.GetAsync(protectedDataUrl);
        var protectedData = await protectedDataResponse.Content.ReadAsStringAsync();

        // Do something with the protected data (parse JSON, display, etc.)
        System.Console.WriteLine(protectedData);
    }
}

3. Handle Token-Based Authentication (If the Site Uses It) #

Some sites return an authentication token (like a JWT) in the login response (either in the response body or headers) instead of cookies. Here’s how to handle that:

// After sending the login POST request:
var loginResponseContent = await loginResponse.Content.ReadFromJsonAsync<LoginResponse>();

// Configure HttpClient to send the token in all subsequent requests
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", loginResponseContent.Token);

// Now access protected data
var protectedDataResponse = await client.GetAsync("https://example.com/protected/data");

// Define a matching class for the login response JSON
public class LoginResponse
{
    public string Token { get; set; }
    // Add other fields from the response if needed
}

Key Tips to Avoid Pitfalls #

• Match Chrome’s Request Headers: Some sites check headers like Referer or Origin—if your login fails, use Chrome’s "Copy as cURL" feature to compare your request headers with the browser’s.
• Check for Redirects: HttpClient automatically follows redirects by default, but you can disable this if you need to inspect the login response directly.
• Debug with Tools: Use Fiddler or the HttpClient logging to see exactly what your app is sending/receiving, and compare it to Chrome’s requests.
• Handle Edge Cases: If the site uses captchas or multi-factor authentication, you’ll need additional logic (like manual input or API integrations) to handle those.

内容的提问来源于stack exchange，提问作者Jan