不理解为什么WinHTTP不验证某些HTTPS资源

Question

我非常感谢任何可以帮助我解决问题的帮助.

从Excel VBA代码我需要从HTTPS站点https://redmine.itransition.com/下载并解析CSV文件.我尝试使用WinHTTP来获取文件.但是,我无法理解为什么身份验证不起作用.这是相关代码:

TargetURL = "https://redmine.itransition.com/projects/pmct/time_entries.csv"
Set HTTPReq = CreateObject("WinHttp.WinHttpRequest.5.1")
HTTPReq.Option(4) = 13056 ' WinHttpRequestOption_SslErrorIgnoreFlags 13056: ignore all err, 0: accept no err
HTTPReq.Open "GET", TargetURL, False
HTTPReq.SetCredentials "UN", "PW", 0
HTTPReq.send

返回以下响应(仅列出某些字符串):

Content-Type: text/html; charset=utf-8
Status: 406
X-Runtime: 5

但是,如果我使用成功的手动身份验证后从Firefox cookie发送"Cookie"字符串

HTTPReq.setRequestHeader "Cookie", SetCookieString
HTTPReq.send

我很容易得到预期的文件.当然,我对这种解决方案不满意,并希望执行真正的WinHTTP身份验证.但是,我无法理解我的代码中出了什么问题或错过了什么.我很可能必须使用.SetClientCertificate方法,但这对我来说还不清楚 - 需要哪个证书？

或者,更一般:我应该使用哪些WinHTTP方法或函数进行调试,以找出哪个步骤阻塞/不正确并阻止我进行正确的身份验证？我花了两周时间通过MSDN和各种资源寻求,但仍然没有解决方案.

提前感谢您的建议!

Answer 1

上面的@Alex K.响应正是我所寻找的那么久!在Firebug和MSDN的帮助下,我完成了3个请求:

• GET请求使用RegEx从登录页面收集authenticity_token数据
• POST请求验证并从响应中收集所需的Cookie字符串
• GET请求最终获得我心爱的CSV

下面的代码正如预期的那样工作:

Set RegX_AuthToken = CreateObject("VBScript.RegExp")
' Below Pattern w/o double-quotes encoded: (?:input name="authenticity_token" type="hidden" value=")(.*)(?:")
RegX_AuthToken.Pattern = "(?:input name=" & Chr(34) & "authenticity_token" & Chr(34) & " type=" & Chr(34) & "hidden" & Chr(34) & " value=" & Chr(34) & ")(.*)(?:" & Chr(34) & ")"
RegX_AuthToken.IgnoreCase = True
RegX_AuthToken.Global = True

TargetURL = "https://redmine.itransition.com/login"

Set HTTPReq = CreateObject("WinHttp.WinHttpRequest.5.1")
HTTPReq.Open "GET", TargetURL, False
HTTPReq.Send

Set Token_Match = RegX_AuthToken.Execute(HTTPReq.ResponseText)
AuthToken = Token_Match.Item(0).SubMatches.Item(0)

PostData = "authenticity_token=" & AuthToken & "&back_url=https://redmine.itransition.com/" & "&username=" & UN & "&password=" & PW & "&login=Login »"

HTTPReq.Open "POST", TargetURL, False
HTTPReq.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
HTTPReq.Send (PostData)

SetCookieString = HTTPReq.GetResponseHeader("Set-Cookie")

TargetURL = "https://redmine.itransition.com/projects/pmct/time_entries.csv"
HTTPReq.Open "GET", TargetURL, False
HTTPReq.setRequestHeader "Cookie", SetCookieString
HTTPReq.Send

以下URL有助于构建POST请求:http://tkang.blogspot.com/2010/09/sending-http-post-request-with-vba.html

您需要加载没有凭据的页面,从生成的表单中获取类似volatile字段authenticity_token的内容并将其与用户名和密码一起发布到/ login.

Alex K. - 再次感谢这个精彩的建议!(: