Python网站登录：Cookie识别及动态表单参数获取疑问

Great question—this is a common pitfall when working with ASP.NET WebForms sites, let’s break this down clearly:

Do you need all those fields? #

Short answer: Yes, nearly all of them are mandatory for a successful login:

• __VIEWSTATE and __EVENTVALIDATION: These are core ASP.NET state management and anti-tampering fields. The server will reject your POST request if these are missing or invalid, since they’re generated per page load to confirm the form came from a legitimate page session.
• txtTaXID and txtPassword: Obvious must-haves—your authentication credentials.
• btnLogin.x and btnLogin.y: These come from an <input type="image"> login button (common in older ASP.NET setups). They represent the X/Y coordinates where the user clicked the button. While some servers might ignore exact values, most require these fields to exist to recognize that the login button was "triggered."

How to handle the dynamic values? #

Let’s turn this into actionable steps with code examples:

1. Fetch the login page first to extract hidden fields #

Before sending your login POST request, you need to GET the login page to grab the current __VIEWSTATE and __EVENTVALIDATION values. These change on every page load, so hardcoding them won’t work.

2. Handle btnLogin.x and btnLogin.y #

You don’t need to "scrape" these values—they aren’t present in the page source. Instead, you can just generate reasonable coordinates:

• Pick numbers within the button’s visible area (e.g., if the button is 100px wide and 30px tall, use x=50 and y=15 for the middle).
• Or generate random values within the button’s dimensions using random.randint().
• Most servers don’t validate the exact coordinates—they just check that the fields exist.

Example Code (Python + Requests + BeautifulSoup) #

import requests
from bs4 import BeautifulSoup
import random

# Use a Session to persist cookies across requests (critical for maintaining login state)
session = requests.Session()

# Set a realistic User-Agent to avoid being flagged as a bot
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
}

# Step 1: Get the login page and extract hidden state fields
login_page_url = "https://your-login-page-url.com"
response = session.get(login_page_url, headers=headers)
soup = BeautifulSoup(response.text, "html.parser")

# Extract __VIEWSTATE and __EVENTVALIDATION from hidden inputs
viewstate = soup.find("input", {"name": "__VIEWSTATE"})["value"]
event_validation = soup.find("input", {"name": "__EVENTVALIDATION"})["value"]

# Step 2: Generate random button coordinates (adjust range based on your button's size)
btn_x = random.randint(0, 100)
btn_y = random.randint(0, 30)

# Step 3: Build the complete form data
form_data = {
    "__VIEWSTATE": viewstate,
    "__EVENTVALIDATION": event_validation,
    "txtTaXID": "your-tax-id-here",
    "txtPassword": "your-password-here",
    "btnLogin.x": str(btn_x),
    "btnLogin.y": str(btn_y)
}

# Step 4: Send the login POST request
login_post_url = login_page_url  # Usually the same as the login page URL, confirm via browser dev tools
response = session.post(login_post_url, data=form_data, headers=headers)

# Verify login success (check for a unique keyword from the homepage)
if "Welcome to your dashboard" in response.text:
    print("Login successful! You're redirected to the homepage.")
else:
    print("Login failed—double-check credentials, or watch for CAPTCHAs/anti-scraping measures.")

Additional Tips #

• Always use requests.Session() to keep cookies alive—this ensures your login session persists after the POST request.
• If the site uses CAPTCHA or other anti-scraping tools, you’ll need to handle those separately (e.g., manual input or specialized solvers).
• Inspect your browser’s network tab (dev tools) to confirm the exact POST URL and form fields—sometimes the form action points to a different URL than the login page.

内容的提问来源于stack exchange，提问作者Will Bachrach