基于FSharp.Data.Http的身份验证

Question

有没有一种使用https进行FSharp.Data身份验证的方法？我正在尝试从这个非公共API下载一个json文件。我的https技能很差，所以我可能遗漏了一些显而易见的东西。到目前为止我试过：

#r "../../../bin/FSharp.Data.dll"    
open FSharp.Data
open System    

let url = "https://app.sablono.com/api/projectStatus.xsjs?project=350f83c2-3f3d-49dc-90ec-cf22d1562c3c2"
let username = "xxx"
let password = "yyy"

let addLogin (req: Net.HttpWebRequest) =
    req.Credentials <- new Net.NetworkCredential(username,password)
    req

let txt = Http.RequestString (url ,customizeHttpRequest = addLogin)

浏览器中的下载在https://app.sablono.com/api/projectStatus.xsjs?project=350f83c2-3f3d-49dc-90ec-cf22d1562c3c2上工作得很好

编辑：，我现在有了这个支持信息：

1. GET - https://app.sablono.com/sap/hana/xs/formLogin/token.xsjs

with RequestHeader : X-CSRF-Token:Fetch
Reply ResponseHeader : X-CSRF-Token
Can be null.
2. POST - https://app.sablono.com/sap/hana/xs/formLogin/login.xscfunc

With RequestHeader : X-CSRF-Token:<Reply from previous request Request>
and Body as - Form Data: 
xs-username=<USERNAME>&xs-password=<PASSWORD>
ResponseHeader: 
set-cookie:xsId04BF0299185B59F3F3F554A382524B98=A22594ACC3339C4F86FAB57F68CF9FDB; path=/; HttpOnly
set-cookie:sapxslb=6D458FD9581EE04333FC0494D0E9F113; path=/; HttpOnly

Answer 1

除非API支持基本身份验证，否则使用NetworkCredential可能不会对您有任何帮助。根据您的额外支持信息，请求正文需要包含您的凭据。以下列方式做某事：

Http.RequestString("https://app.sablono.com/sap/hana/xs/formLogin/login.xscfunc",
    body = FormValues ["xs-username","username";"xs-password","password"])

如果所有这些都失败了，我建议您使用Fiddler之类的方法检查您的传出http请求，然后将其与API所期望的进行比较。

下面是上一次调用的示例，其中添加了标头中添加的令牌：

Http.RequestString("https://app.sablono.com/sap/hana/xs/formLogin/login.xscfunc",
    body = FormValues ["xs-username","username";"xs-password","password"],
    headers = [ "X-CSRF-Token", "reply from first request" ])

Answer 2

我无法让它与FSharp.data Http一起工作。所以最终我解决了这个问题：

open System.Text
open System.Net
open System.IO

let get projectId = 
    let un = "USERNAME"
    let pw = "password"    


    let cookieCont = 
        let token = 
            printfn "getting token.."
            let req1 = HttpWebRequest.Create "https://app.sablono.com/sap/hana/xs/formLogin/token.xsjs" :?> HttpWebRequest
            req1.Headers.Add("X-CSRF-Token", "Fetch") //You have to add the X-CSRF-Token = Fetch so that the system can reply with the other token   
            let resp = req1.GetResponse()
            resp.Headers.Get("X-CSRF-Token") //The first time the token is "unsafe"

        let jar = new CookieContainer()
        let req2 = HttpWebRequest.Create "https://app.sablono.com/sap/hana/xs/formLogin/login.xscfunc" :?> HttpWebRequest
        let byteArray = 
            let postData = "xs-username=" + un + "&xs-password=" + pw
            Encoding.UTF8.GetBytes(postData)

        req2.CookieContainer <- jar
        req2.Method <- "POST"
        req2.Headers.Add("X-CSRF-Token", token)
        req2.ContentType <-"application/x-www-form-urlencoded charset=UTF-8"
        req2.ContentLength <- int64 byteArray.Length

        //Put username and password inside the body
        use dataStream = req2.GetRequestStream()
        dataStream.Write(byteArray, 0, byteArray.Length)

        let _ = // this is to avoid 401 error
            let login_resp = req2.GetResponse()
            login_resp.GetResponseStream() 

        dataStream.Close()
        jar

    printfn "downloading JSON .."     
    let req3 =  HttpWebRequest.Create ("https://app.sablono.com/api/projectStatus.xsjs?project=" + projectId)  :?> HttpWebRequest
    req3.AutomaticDecompression <- DecompressionMethods.GZip
    req3.CookieContainer <- cookieCont
    req3.ContentType <- "application/jsoncharset=UTF-8"
    req3.Accept <- "application/json"

    let resultJSON = 
        let resp = req3.GetResponse()
        let respStream = resp.GetResponseStream()
        use reader = new StreamReader(respStream)
        reader.ReadToEnd()

    resultJSON