Question

In this question I asked how to POST to a php file form a vb.net app: POST to webpage in vb.net (win forms, desktop, not ASP.net)
So now I’ve logged in the user user by posting their username and password to the php file, the php file then does security/checks they exist/etc and if both username and password are correct is stores the user ID in a session variable.

Now if the vb.net app tries to download data off a page which needs the user to logged in, it checks this by doing:

if (!isset($_SESSION['uid'])) {
    header("Location: index.php");
}

However after having logged correctly in the app the session variable is not set.
How does session work with a vb.net app like this?

When the user logs in successfully should I download the user id and keep it in the vb.net app and then post it to each page that requires authentication?

Answer 1

To have your PHP website recognize the VB.NET client as a logged on user you need to send a cookie. When you use session_start() in PHP, PHP will set a random ID in the visitors cookie to link the session with. What you need to know is what this ID is. More specifically, on your first request to the website, you should read this out.

In your other question I saw you are using a WebClient instance. If you sent a request, there is also a property called ResponseHeaders. This is a collection that contains the response headers from the webserver (in this case the webserver that’s running your site). This will likely contain a cookie code too.

For example:

Dim myWebClient As New WebClient

Dim responseArray = myWebClient.UploadData("http://...", "POST", Encoding.ASCII.GetBytes(postData))
Dim MyCookie As String = cl.ResponseHeaders.Item(HttpResponseHeader.SetCookie)

myWebClient.Headers.Add(HttpRequestHeader.Cookie, MyCookie)

You have to process the responseArray in this example, but this is the basic principle for storing a cookie and sending it back. The next request you send out with the same instance of this WebClient will contain the cookie your site responded with the last request. Basically it means, the SessionID that the PHP site creates will be membered and send back.

Personally I would write a little wrapper class around this. Just make a function that sends out a login request to your specific site. Then store the cookie, and every request you will send later you add this cookie to it. You could easily write a ‘generic’ method like
string GetPage(string URL);
string PostPage(string URL, string PostData)
etc.