0

I want to write a program which will log in to squareup.com. So for this I need to know where the form is located and to where is it submitted.

So the form is located at https://squareup.com/login, and the source code contains the following:

<form accept-charset="UTF-8" action="/mp/login"
         class="signin-page-form " method="post" novalidate="novalidate">

As much as I understand this means the submition URL is located at squareup.com/mp/login. Yet when I try this URL in a browser I get the 404 error. What am I not doing right?

Improve this question
8
  • Have you tried the URL with the login parameters, or only the bare URL with no paramaters?
    – Stephen Ostermiller ♦
    Commented Mar 6, 2019 at 20:50
  • @StephenOstermiller I get the error 'Error' with my Python code when I try it with login and password, but how can I try this in a browser?
    – sequence
    Commented Mar 6, 2019 at 21:10
  • 1
    I'd recommend using a browser plugin like Live HTTP Headers to see exactly what is actually being submitted.
    – Stephen Ostermiller ♦
    Commented Mar 6, 2019 at 21:16
  • 2
    @elbrant That's not the case. Note that the action attribute contains a root-relative URL. What you are suggesting would only occur if the form was located at example.com/login/ (note the trailing slash) and the submission URL was mp/login (note the omission of the slash prefix - a relative URL).
    – DocRoot
    Commented Mar 7, 2019 at 11:18
  • 2
    Are you following some kind of API? (It doesn't look like it.) Even if you get the correct URLs to submit the form to, that form contains additional security measures (such as an authenticity_token that varies per session) that you would also need to satisfy before a form submission would be successful.
    – DocRoot
    Commented Mar 7, 2019 at 11:40

2 Answers 2

Reset to default
3

You're right that the form will be submitted to https://squareup.com/mp/login, and that when you just put that URL into a browser, you get a 404. That's because when you type web addresses into a browser, the browser makes a GET request, but the page at https://squareup.com/mp/login is expecting a POST request.

GET and POST are HTTP methods. The address bar of a web browser will only generate GET method requests. If you want to generate POST method requests you need to try Postman, a wonderful app for working with all types of web requests and APIs.

Improve this answer
2

As stated you should use POST method instead of GET.

BUT there's more..

This site is probably using Laravel, because I can see csrf-token in the <head> of the login page (all other pages too of course), so if you stumble upon 422/403/500 or anything other than 404/200 HTTP status codes, you might need to add the _token parameter with the value of the current token on the page which you can find in <head> (And I am not even sure if it would work, but theoritically it could), this would probably require some web scrap, also this token has a short lifespan so be aware of the fact, that you might wanna refresh this token (web scrap again) from time to time to cover scenarios where users will have X minutes of innactivity on your page before trying to login to squareup.

Improve this answer
2
  • Do you mean that token is available within the login form page code?
    – sequence
    Commented Mar 8, 2019 at 16:59
  • Yes, it's in the <head> of the html in the login form page, note that the csrf token of laravel, is available on all pages, and has to be submitted with every form, you can read more for it in the Laravel docs here laravel.com/docs/5.8/csrf otherwise you would get Access errors, sometimes it might just say Method not allowed or some other not really clear error message if the token isn't presented as parameter in the request
    – knif3r
    Commented Mar 13, 2019 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.