title: replay forms authentication session cookies to ASP.NET via phantomjs
body: <h2>Goal</h2>
  <p>My goal is to replay a set of ASP.NET Forms Authentication session cookies through a phantomjs script.</p>
  <h2>What I've tried</h2>
  <p>My phantomjs script is below. The script works if I replay the cookies to the website hosted in my local VS2010 ASP.NET Development Server. However, if I try the same code on the website hosted on IIS6, the replay fails.</p>
  <p>The replay appears to work fine when the code is running on IIS7</p>
  <p>Note: I do realize that the authentication cookies are different for the two different sessions (IIS and ASP.NET Development Server), and I am using the correct cookies for each session.</p>
  <h2>Suspicions</h2>
  <p>I suspect that there is either:</p>
  <ul>
  <li>a problem with the value I am using for the cookie's domain</li>
  <li>a difference between how IIS6 and VS handle authentication cookies, maybe IIS6 won't accept a replay from a different IP?</li>
  </ul>
  <h2>Script</h2>
  <pre><code>var page = require('webpage').create();  
  
  var tests = {
      'localhost': {
          url: 'http://localhost/Test.aspx',
          cookies: 
              [{
                  &quot;name&quot;:&quot;ASP.NET_SessionId&quot;
                  ,&quot;value&quot;:&quot;abcdefghijk&quot;
                  ,&quot;domain&quot;:'localhost'
              },{
                  &quot;name&quot;:&quot;.ASPXFORMSAUTH&quot;
                  ,&quot;value&quot;:&quot;2D23D9EFF2F538...&quot;
                  ,&quot;domain&quot;:'localhost'
              }]
      },
      'www.myserver.com': {
          url: 'http://www.myserver.com/Test.aspx',
          cookies: 
              [{
                  &quot;name&quot;:&quot;ASP.NET_SessionId&quot;
                  ,&quot;value&quot;:&quot;lmnopqrstuv&quot;
                  ,&quot;domain&quot;:'www.myserver.com'
              },{
                  &quot;name&quot;:&quot;.ASPXFORMSAUTH&quot;
                  ,&quot;value&quot;:&quot;9EFF2F53823BDA...&quot;
                  ,&quot;domain&quot;:'www.myserver.com'
              }]      
      }   
  };
  
  // uncomment the test you want to perform
  var test = tests['localhost'];
  // var test = tests['www.myserver.com'];
  
  phantom.addCookie(test.cookies[0]);
  phantom.addCookie(test.cookies[1]);
  
  page.open(test.url, function (status) {
      if (status !== 'success') {
          console.log('Unable to access network');
      } else {        
          console.log(page.content);
      }
      phantom.exit();
  });
  </code></pre>
  <h3>Work-around:</h3>
  <p>Since the issue only occurs in my development environment: As a work-around, I created a web service that would return a session and authentication cookie. Then open that service from my PhantomJS script so that the cookie would be added to the current PhantomJS context. Then I would open the real url that I was targeting. Handing our authentication cookies without actually authenticating the user is a bit of a security hole, so I wrap it in compiler directives so that it's not available in the production build.</p>
  <p>C#</p>
  <pre><code>HttpContext.Current.Response.Cookies.Add(FormsAuthentication.GetAuthCookie(username, true, &quot;/&quot;));
  </code></pre>
  <p>js:</p>
  <pre><code>page.open(authUrl, function (status) {
      page.open(address, function (status) {
      });
  });
  </code></pre>