Problems in HTTPS Post Login to a form inside Iframe from Java

[Ishan Ganeshan]

I am trying to login to a website https://online.firstdata.de/esp/concardis/

The problem is that the login form through which a post request is made to the server is placed inside an iframe. The url of the login form is actually a redirect link and the user is redirected to another url which then renders the after login page. When I make a post request to the url of this login form from java then instead of redirecting the page to the another url the post request returns an error page. Does anybody have any knowledge of how to login to a form inside an iframe which redirects to another link from Java?

CookieHandler.setDefault(new CookieManager(null, CookiePolicy.ACCEPT_ALL));

getRequest("https://online.firstdata.de/esp/concardis/",null,false);

String postParams = "?j_username="+URLEncoder.encode(userName, "UTF-8")+"&j_password="+URLEncoder.encode(password, "UTF-8");


sendPost("https://online.firstdata.de/login/j_security_check",postParams);

private void sendPost(String url,String postParams) throws Exception {


    // Create a trust manager that does not validate certificate chains
     TrustManager[] trustAllCerts = new TrustManager[] { 
         new X509TrustManager() {     
             public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
                 return new X509Certificate[0];
             } 
             public void checkClientTrusted( 
                 java.security.cert.X509Certificate[] certs, String authType) {
                 } 
             public void checkServerTrusted( 
                 java.security.cert.X509Certificate[] certs, String authType) {
             }
         } 
     }; 

     // Install the all-trusting trust manager
     try {
         SSLContext sc = SSLContext.getInstance("SSL"); 
         sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
         HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
     } catch (GeneralSecurityException e) {
     } 
     // Now you can access an https URL without having the certificate in the truststore

        HttpsURLConnection conn;
        URL obj = new URL(url);
        conn = (HttpsURLConnection) obj.openConnection();

        byte[] postData       = postParams.getBytes( StandardCharsets.UTF_8 );
        // Acts like a browser
        conn.setRequestMethod("POST");

        conn.setRequestProperty("Accept",                   "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
        conn.setRequestProperty("Accept-Encoding","gzip,deflate");
        conn.setRequestProperty("Accept-Language", "en-GB,en;q=0.8,en-US;q=0.6,da;q=0.4");
        conn.setRequestProperty("Cache-Control", "max-age=0");
        conn.setRequestProperty("Connection", "Keep-Alive");
        conn.setRequestProperty("Content-Length", Integer.toString(postData.length ));
        conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");//text/html;charset=ISO-8859-1
        //conn.setRequestProperty( "charset", "utf-8");
        for (String cookie : this.cookies) {
            conn.addRequestProperty("Cookie", cookie);
        }
        conn.addRequestProperty("Cookie","NSC_POMJOF-GE=ffffffff09425a7045525d5f4f58455e445a4a42122b");
        conn.setRequestProperty("Host","online.firstdata.de");
        conn.setRequestProperty("Origin","https://online.firstdata.de");
        conn.setRequestProperty("Referer", "https://online.firstdata.de/login/postlogin/UserDispatcher");
        conn.setRequestProperty("User-Agent", USER_AGENT);  
        conn.setUseCaches(false);
        conn.setDoOutput(true);
        HttpsURLConnection.setFollowRedirects(false);
        conn.setInstanceFollowRedirects(false);
        conn.connect();

        // Send post request

        DataOutputStream wr = new DataOutputStream(conn.getOutputStream());
        wr.writeBytes(postParams);
        wr.flush();
        wr.close();

        int responseCode = conn.getResponseCode();

            // Get the response cookies
            if(conn.getHeaderFields().containsKey("Set-Cookie")){

                for(String cookie : conn.getHeaderFields().get("Set-Cookie")){
                    this.cookies.add(cookie);
                }
            }
            String location = "";
            if(conn.getHeaderFields().containsKey("Location")){

                location = conn.getHeaderFields().get("Location").get(0);
            }
            conn.disconnect();
}




private String getRequest(String url,String referer,boolean isPostParams) throws Exception {
    HttpsURLConnection conn;
    URL obj = new URL(url);
    conn = (HttpsURLConnection) obj.openConnection();

    conn.setRequestMethod("GET");

    conn.setUseCaches(false);

    // act like a browser
    conn.setRequestProperty("Accept",
            "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");

    conn.setRequestProperty("Accept-Language", "en-GB,en;q=0.8,en-US;q=0.6,da;q=0.4");
    conn.setRequestProperty("Cache-Control", "max-age=0");
    conn.setRequestProperty("Connection", "keep-alive");
    conn.setRequestProperty("Host","online.firstdata.de");
    conn.addRequestProperty("Cookie","NSC_POMJOF-GE=ffffffff09425a7045525d5f4f58455e445a4a42122b");
    if(referer!=null)
        conn.setRequestProperty("Referer", referer);
    conn.setRequestProperty("User-Agent", USER_AGENT);
    conn.setDoOutput(true);
    conn.setDoInput(true);
    HttpsURLConnection.setFollowRedirects(false);
    conn.setInstanceFollowRedirects(false);
    if (cookies != null) {
        for (String cookie : this.cookies) {
            conn.addRequestProperty("Cookie", cookie);
        }
    }
    conn.connect();

    if(isPostParams){
        DataOutputStream wr = new DataOutputStream(conn.getOutputStream());
        wr.writeBytes(postParams);
        wr.flush();
        wr.close();
    }


    int responseCode = conn.getResponseCode();

    BufferedReader in =
            new BufferedReader(new InputStreamReader(conn.getInputStream()));
    String inputLine;
    StringBuffer response = new StringBuffer();

    while ((inputLine = in.readLine()) != null) {
        response.append(inputLine+"\n");
    }
    in.close();

    // Get the response cookies
    if(conn.getHeaderFields().containsKey("Set-Cookie")){

        for(String cookie : conn.getHeaderFields().get("Set-Cookie")){

            this.cookies.add(cookie);
        }
    }

    String location = "";
    if(conn.getHeaderFields().containsKey("Location")){

        location = conn.getHeaderFields().get("Location").get(0);
    }
    conn.disconnect();

    return location;
  }

[Tim Moores]

I'm not sure what the problem is, but if this was my problem, I'd use the HtmlUnit library - IMO the best Java library for programmatic web access.

[Ishan Ganeshan]

Thanks for your reply. Problem is that my post request to the login form is rejected as the url that i post to is a redirect link to another url. It logs in my correctly when i do from browser. But from java some reason it is not.

[Tim Moores]

HtmlUnit can be set to handle redirects (or even does so by default, I'm not sure).

[Ishan Ganeshan]

Ok thanks i would try with htmlunit

[Ishan Ganeshan]

I tried using htmlunit but since the redirect page is the same as the page containing the form inside an iframe hence it enters into an infinite loop. This is a general problem with html unit i think. When the url of the redirect page is the same as the page from which the request originates then it enters into an infinite loop. Problem is that in my page the form is inside an iframe. Below is a brief description of problem :


I am trying to login to a web page https://online.firstdata.de/esp/concardis/ using HTMLunit library in Java. The thing is that this page contains a form inside a couple of iframes. The source of the iframe containing the form is https://online.firstdata.de/login/postlogin/UserDispatcher . When a form is submitted then one of the redirect links before the next page is rendered is also the same link as mentioned above. So, this creates an infinite loop when I use it from Java. However, when the login happens from the browser because the main source of the originating page was the link ending with /concardis the redirect link is not the same as this link and hence there is no infinite loop. How can I simulate this same behaviour from Java? Here is my code :

WebClient webClient = new WebClient(BrowserVersion.CHROME);

    webClient.getOptions().setJavaScriptEnabled(true);
    webClient.getOptions().setRedirectEnabled(true);
    webClient.getOptions().setThrowExceptionOnScriptError(false);
    webClient.getOptions().setCssEnabled(false);    
    webClient.setAjaxController(new NicelyResynchronizingAjaxController());


    try{


        HtmlPage page1 = null;
        HtmlPage page2 = null;
        HtmlPage page3 = null;
         HtmlPage page = webClient.getPage("https://online.firstdata.de/esp/concardis");




        List<FrameWindow> frames = page.getFrames();
        for (FrameWindow frame : frames) {
            if (frame.getFrameElement().getNameAttribute().equals("application")) {
                page1 = webClient.getPage(frame.getEnclosedPage().getUrl());
            }
        }

        List<FrameWindow> frames1 = page1.getFrames();
        for (FrameWindow frame : frames1) {
            if (frame.getFrameElement().getNameAttribute().equals("content")) {
                page2 = webClient.getPage(frame.getEnclosedPage().getUrl());
            }
        }

        List<FrameWindow> frames2 = page2.getFrames();
        for (FrameWindow frame : frames2) {
            if (frame.getFrameElement().getId().equals("loginFrame")) {
                page3 = webClient.getPage(frame.getFrameElement().getSrcAttribute());
            }
        }


        HtmlForm form = page3.getFormByName("loginForm");
        HtmlTextInput userName = form.getInputByName("j_username");
        HtmlPasswordInput password = form.getInputByName("j_password");

        userName.setValueAttribute("username");
        password.setValueAttribute("password");

        HtmlSubmitInput submit = form.getInputByName("Submit");

        submit.click();

[Tim Moores]

My guess would be that either cookies or the referer header are not set and/or sent correctly - both seem to be missing from the code.