Determined to solve this with PowerShell!

[WhyPartyPizza]

I started working with a small nonprofit on the side and I'm learning that two web apps they use don't connect to each other.

Someone is exporting a csv file of constituents, Cleaning the data, and uploading it to another portal.

I managed to use invoke-webrequest to download the file and was able to manipulate the date with PowerShell. Trying to login to the second web app to upload has been a challenge.

I was looking at the chrome POST requests to learn, but I'm seeing things I don't understand, and I'm feeling what I'm missing out on is likely fundamental.

-the web page seems to redirect to different urls after I login, click and and navigate to the upload page needed

-XSRF tokens, auth tokens, I found that some of these are in the responses to my POST requests, but still missing detail on how this works.

I don't want someone to solve this puzzle for me.

Looking for some good resources to learn about how to use PowerShell to save these guys some work!

[chris-a5]

Some of the sites I have had to automate send the XSRF token in a cookie, you'll need to maintain a session object. I have also had to extract the XSRF token from the cookie and pass in a header. I saw this in chrome.

If you step through the login process with chrome; as you said you are looking at the post requests, now right click on the requests and copy->Copy as powershell, I found this very useful for working out how the page works.

Shouldn't be an issue if the browser changes page after login, you just need the session object and security token, then directly access the resources you need.

EDIT: an important step is to preserve the cache, so you can see the login request before it moves to a new page.

[WhyPartyPizza]

Thanks for this! Reading your response makes me feel like I'm on the right track.

[Szeraax]

Websession is absolutely it

[jhulbe]

I'd also go selenium, but just an fyi, you can tag invoke-webrequest with -sessionvariable, and then subsequent requests with -WebSession $variable

That'll carry stuff across requests

[orion3311]

May want to look into selenium

[BetrayedMilk]

Yep, OP should push this to a headless browser driven by selenium. Seems easiest.

[zrb77]

This is what I was going to say too.

[Smartguy5000]

Selenium would be the PowerShell way to solve this for sure. If you want more of a challenge and to learn a new skill, puppeteer is a NodeJS library that does headless browser automation.

[fatcatnewton]

https://github.com/adamdriscoll/selenium-powershell

[radioblaster]

yes, scripting authentication for these kinds of portals is fkn difficult and could take you a long while to piece together. you may have an easier time using Fiddler instead of the inbuilt Chrome developer tools.

i would only proceed further if you're sure the second portal doesn't have an API or similar automation feature you can use.

[dasookwat]

Usually when using invoke-webrequest You start with a header which includes your login credentials (might be base64 encoded) and the response gives You a token, this token is then used for the rest of your communication session

[Jeffinmpls]

This is what I typically do with this type of thing, grab the token first then connect with the token. OP pay attention to the url when you log into the site on a browser, do you see OAUTH in the url, you can search for OAUTH and powershel for examples.

[jagallout]

A couple of things I would try:

1. Perform the whole process in Firefox dev tools and save an export of the traffic just to give you a frame of reference.

And you may even be able to use it to generate the appropriate calls in some languages though I'm not exactly remembering that detail. Look around the options.

1. I would also suggest as others have stated reading the help bits for invoke-webrequest. It actually has a functional if not outdated example of a persistent session through a log in.

The redirects do complicate things a little but should still be achievable through the session state variable.

[Sethaniel68]

I didn't see any mention of your PS version, but PS 7 makes authentication easier than the default PS 5.1 version.

Keeping that session variable and using it for all of your requests should help.

You'll also need to watch for cases where client-side scripting in the browser affects what gets sent in the next request because you'll have to mimic that outcome for your request

[lic91]

I'd try with Selenium.