Forgot your password?
typodupeerror
User Journal

Chacham's Journal: Question: Cross-site POSTing with ASP .NET 1.1 and IIS 5? 2

Journal by Chacham

This should be simple. I've been asked to help suppliers coming in through Covisint (authenticated via siteminder, though i really haven't even looked at it), to log into Microsoft Project Web Access (2003) without signing in. The idea is to sign them in automatically via a supplier id in the headers. That is where i take over.

To login to PWA, Project provides a set of files. For ease, lgnps.asp can be used. By itself it shows a page with a blurb, a user/pass combo, and a submit button. Whittling it down showed me that it'll do it's job as a simple POST of username and password. That is, the following code works:

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML>
  <HEAD>
  <TITLE>Moo</TITLE>
  </HEAD>
  <BODY>
  <FORM Method = "Post" Action = "lgnps.asp">
  <INPUT Name = "userName" Value = "moo">
  <INPUT Name = "password" Value = "cow">
  <INPUT Type = "Submit">
  </FORM>
  </BODY>
</HTML>

The suppliers are not required to know their ids, nor do we want to advertise it to them. So the login is best done surreptitiously, and they will be very restricted within PWA, i'm told.

I've been having problems. PWA requires a POST, GET does not work, which means a FORM is required. I figured i could make a blank form and have the username and password filled in after the button was clicked. That caused two issues. I can't use javascript to submit the form automatically (so they must click it) and it's ASP .NET 1.1 where FORMs ignore supplied Action attributes, and it POSTs to itself. (.NET 2.0 added POSTing to a different page.)

After digging, i found RewritePath, so now i could POST to a new page. However, it must be in the same application root. I need to POST to our Project Server (which is on a different server). So, i had this great idea, make a directory in IIS that points to the other server. That much worked, accept POST vars are not passed. That functionality was added in IIS 6.

Now i think i'll try just putting this page in Project Server's virtual root, so the POST isn't cross-site. I was hoping to keep all custom pages on the web server.

Any ideas?

UPDATE: The project's Project Server server does not have ASP .NET exabled, and i'm not sure i can find a way to make asp pages here.

This discussion has been archived. No new comments can be posted.

Question: Cross-site POSTing with ASP .NET 1.1 and IIS 5?

Comments Filter:
  • by Bill Dog (726542)
    ...and it's ASP .NET 1.1 where FORMs ignore supplied Action attributes, ...

    I've been a "classic ASP"'er, and haven't touched .Net, but I don't see how this can be true. If I make an HTML form and tell it to submit to a given URL, that's where the browser will try to send it, no matter what framework (ugh) some server somewhere is running.
    • by Chacham (981)
      As you said, you have never used ASP .NET. :)

      It rewrites most of the page, and by default it always submit to itself by rewriting the Action attribute of the form tag. .NET is a fantastic framework, but 1.1 takes away a lot of functionality which had to wait for 2.0.

      The reason for it is session handling, as it help the server keep a consistent state (it adds a hidden session state to the form).

backups: always in season, never out of style.

Working...