# How can I determine where a login form is submitted?

I want to write a program which will log in to squareup.com. So for this I need to know where the form is located and to where is it submitted.

So the form is located at https://squareup.com/login, and the source code contains the following:

<form accept-charset="UTF-8" action="/mp/login"
class="signin-page-form " method="post" novalidate="novalidate">


As much as I understand this means the submition URL is located at squareup.com/mp/login. Yet when I try this URL in a browser I get the 404 error. What am I not doing right?

• Have you tried the URL with the login parameters, or only the bare URL with no paramaters? – Stephen Ostermiller Mar 6 '19 at 20:50
• @StephenOstermiller I get the error 'Error' with my Python code when I try it with login and password, but how can I try this in a browser? – sequence Mar 6 '19 at 21:10
• I'd recommend using a browser plugin like Live HTTP Headers to see exactly what is actually being submitted. – Stephen Ostermiller Mar 6 '19 at 21:16
• @elbrant That's not the case. Note that the action attribute contains a root-relative URL. What you are suggesting would only occur if the form was located at example.com/login/ (note the trailing slash) and the submission URL was mp/login (note the omission of the slash prefix - a relative URL). – DocRoot Mar 7 '19 at 11:18
• Are you following some kind of API? (It doesn't look like it.) Even if you get the correct URLs to submit the form to, that form contains additional security measures (such as an authenticity_token that varies per session) that you would also need to satisfy before a form submission would be successful. – DocRoot Mar 7 '19 at 11:40

This site is probably using Laravel, because I can see csrf-token in the <head> of the login page (all other pages too of course), so if you stumble upon 422/403/500 or anything other than 404/200 HTTP status codes, you might need to add the _token parameter with the value of the current token on the page which you can find in <head> (And I am not even sure if it would work, but theoritically it could), this would probably require some web scrap, also this token has a short lifespan so be aware of the fact, that you might wanna refresh this token (web scrap again) from time to time to cover scenarios where users will have X minutes of innactivity on your page before trying to login to squareup.