不理解为什么WinHTTP不能验证某些HTTPS资源 [英] Not understanding why WinHTTP does NOT authenticate certain HTTPS resource
问题描述
我对任何形式的帮助，可以帮助我解决这个问题非常感激。
I'd be extremely grateful for any kind of help that may help me resolving the problem.
从Excel中VBA code我需要下载和放大器;解析来自HTTPS网站 https://redmine.itransition.com/ 的CSV文件。我尝试使用的WinHTTP来获取文件。不过，我不明白为什么验证不起作用。这里是一块相关code的：
From Excel VBA code I need to download & parse CSV file from HTTPS site https://redmine.itransition.com/. I try to use WinHTTP to get the file. However, I can't understand why authentication does not work. Here is the piece of related code:
TargetURL = "https://redmine.itransition.com/projects/pmct/time_entries.csv"
Set HTTPReq = CreateObject("WinHttp.WinHttpRequest.5.1")
HTTPReq.Option(4) = 13056 ' WinHttpRequestOption_SslErrorIgnoreFlags 13056: ignore all err, 0: accept no err
HTTPReq.Open "GET", TargetURL, False
HTTPReq.SetCredentials "UN", "PW", 0
HTTPReq.send
返回以下响应（仅适用于某些字符串列）：
returns the following response (only certain strings are listed):
Content-Type: text/html; charset=utf-8
Status: 406
X-Runtime: 5
不过，如果我使用send从Firefox的cookie曲奇字符串手动成功验证之后
However, if I send "Cookie" string from Firefox cookie after successful manual authentication using
HTTPReq.setRequestHeader "Cookie", SetCookieString
HTTPReq.send
我很容易得到预期的文件。我当然不满意这样的解决方案，并要执行真正的WinHTTP的验证。不过，我不明白什么是错的还是我在code错过了什么。最有可能的我必须使用 .SetClientCertificate 方法，但不清楚这个对我来说 - 这证书是必需的。
I easily get the expected file. Of course I'm not happy with such solution, and want to perform true WinHTTP authentication. However, I can't understand what's wrong or what I miss in my code. Most likely I have to use .SetClientCertificate method, but this is unclear for me - which cert is required?
或者是更普遍的：它WinHTTP的方法或函数，我应该用于调试，找出哪一步阻止/不正确的，prevents我从正确的验证？我待了两个星期通过MSDN和各种资源寻找，但仍然没有解决。
Or, being more general: which WinHTTP methods or functions I should use for debugging to find out which step is blocking / incorrect and prevents me from correct authentication? I spent 2 weeks seeking through MSDN and various resources, but still have no solution.
在此先感谢您的建议！
推荐答案
从 HTTPS的登录：//redmine.itransition。 COM / 仅仅是一个HTML表单职位用户名和放大器;密码脚本在 /登录。
The logon at https://redmine.itransition.com/ is just an HTML form that posts a username & password to a script at /login.
这是不是与 setCredentials方法兼容这是专为像基本/摘要/ NTLM基于服务器的身份验证方案。
This is not compatible with SetCredentials which is designed for server based authentication schemes like basic/digest/ntlm.
您需要加载网页没有凭据，抢什么样子的挥发性字段从生成的表单和放大器 authenticity_token ;后，随着用户名和放大器;密码 /登录。
You need to load that page with no credentials, grab what looks like the volatile field authenticity_token from the generated form & post that along with username & password to /login.
如果它是一个基于会话的系统，它将响应与Set-cookie头+数据，需要在后续请求中使用。
If its a session based system it will response with the set-cookie header + data you need to use in subsequent request.
这篇关于不理解为什么WinHTTP不能验证某些HTTPS资源的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
