HttpClient Post only works when fiddler is running

Question

public async Task<LoginResult> Login(string username, string password)
    {
        cookies = new CookieContainer();
        handler = new HttpClientHandler()
        {
            CookieContainer = cookies,
            UseCookies = true,
            AllowAutoRedirect = true,
            UseProxy = true,
            Proxy = null
        };
        ThreadActivity.Account = username;
        ThreadActivity.Status = "Logging in...";
        LoginResult result = new LoginResult();
        try
        {
            cookies = new CookieContainer();
            client = new HttpClient(handler);
            client.DefaultRequestHeaders.Connection.Add("keep-alive");
            client.DefaultRequestHeaders.CacheControl = new CacheControlHeaderValue() { MaxAge = TimeSpan.Zero };
            client.DefaultRequestHeaders.Add("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
            client.DefaultRequestHeaders.Add("Accept-Encoding", "gzip,deflate,sdch");
            client.DefaultRequestHeaders.Add("Accept-Language", "en-US,en;q=0.8");
            client.DefaultRequestHeaders.Add("Accept-Charset", "ISO-8859-1");
            client.DefaultRequestHeaders.Add("User-Agent", "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.76 Safari/537.36");

            HttpResponseMessage hr = await client.GetAsync("https://instagram.com/accounts/login/#");
            if (!hr.IsSuccessStatusCode)
                throw new Exception("Couldn't load instagram page; " + hr.ReasonPhrase);
            string source = await hr.Content.ReadAsStringAsync();
            //Get login token
            string token = ParseFormNameText(source, "csrfmiddlewaretoken");
            //Login
            HttpContent content = new FormUrlEncodedContent(new[]
            {
                    new KeyValuePair<string,string>("csrfmiddlewaretoken", token),
                    new KeyValuePair<string, string>("username", username),
                    new KeyValuePair<string, string>("password", password)
            });
            client.DefaultRequestHeaders.Referrer = new Uri("https://instagram.com/accounts/login/");
            hr = await client.PostAsync("https://instagram.com/accounts/login/", content);
            if (!hr.IsSuccessStatusCode)
                throw new Exception("Couldn't submit login; " + hr.ReasonPhrase);
            source = await hr.Content.ReadAsStringAsync();
            if (source.Contains("Please enter a correct username and password"))
                throw new Exception("Couldn't login; invalid username/password.");
            //Logged in, login to webstagram now
            hr = await client.GetAsync("https://instagram.com/oauth/authorize/?client_id=9d836570317f4c18bca0db6d2ac38e29&redirect_uri=http://web.stagram.com/&response_type=code&scope=likes+comments+relationships");
            if (!hr.IsSuccessStatusCode)
                throw new Exception("Couldn't load webstagram login; " + hr.ReasonPhrase);
            source = await hr.Content.ReadAsStringAsync();
            if (!source.Contains(">LOG OUT</a>"))
                throw new Exception("Couldn't load webstagram; failed to login.");
            RaiseEvent("Logged in!", this);
        }
        catch (Exception ex)
        {
            RaiseEvent(ex.Message, this);
            result.ErrorMessage = ex.Message;
        }
        finally
        {
            result.Success = string.IsNullOrEmpty(result.ErrorMessage);
        }
        return result;
    }

This is my login method, however when it actually tries to submit the login, I get a 403 forbidden error. But when I try and do it with Fiddler running, it works.

I'm not quite sure why it's doing this, maybe someone could help?

Answer 1

I had a similar issue once. The problem was that Fiddler - when intercepting the traffice - changed the request. I think in our case the proxy server was configured to block requests like this (the ASP.net request, failed) "CONNECT www.20min.ch" and Fiddler changed the request to "CONNECT http://www.20min.ch" which was allowed to pass the proxy (worked). Maybe you need to use Wireshark to compare the request from Fiddler and ASP.net and look for the difference between them.