[RESOLVED] Log in to web Data with User and Password
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
Adie · 2026-02-05 12:55

Hi
*** TOTALLY NEWBIE WRT ALL THINGS INTERNET ***

Using Lazarus 4.4 and WIN11Pro

I need to log in to SAP S/4 HANA to retreive data via their API

****** BUT i can not even log in to the site below with given User and
Passw. *****

  URL  := 'https://practicetestautomation.com/practice-test-login/';
  User := 'student';
  Pass := 'Password123';

The sample site give info to test but I do not get ANY relevant
response. 

I tried more than 10 samples in this forum and other without success.

Any help would be appreciated.

Adie

----------------------------------------------------------------------
Adie · 2026-02-05 22:24

OK, I can log in to the web page but get this error

"CSRF token is missing"

** Code Snippet **
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i   //
Initialize SSL if using HTTPS  InitSSLInterface;  HTTP :=
TFPHTTPClient.Create(nil);  try    // Enable redirects to maintain
session    HTTP.AllowRedirect  := True;    HTTP.KeepConnection :=
True;//    HTTP.Cookies.Add('session_id=12345');     FormData :=
TStringList.Create;    try      FormData.Values['sap-alias'] :=
Username;      FormData.Values['sap-password'] := Password;       //
Add any other required fields (e.g., anti-CSRF token if present)>> not
working      FormData.Values['CSRF-token'] :=
'a7b8c9d0e1f2g3h4i5j6k7l8m9n0o1p2'; // <======== Not working ??      
Response := TStringStream.Create('');      try        // Send the POST
request        HTTP.FormPost(TargetURL, FormData,
Response);ShowMessage( HTTP.Connected.ToInteger.ToString);ShowMessage(
HTTP.RequestHeaders.Text);        // You can read the response content
from the Response stream if needed        ShowMessage(
Response.DataString);       finally        Response.Free;      end;  
finally      FormData.Free;    end;  finally    HTTP.Free;  end;

----------------------------------------------------------------------
paweld · 2026-02-06 12:09

The login code on this page is written in JS and does not retrieve
data sent using the POST method, only data from form controls. The
easiest way is to use Selenium:
https://forum.lazarus.freepascal.org/index.php/topic,50082.msg364923.
html#msg364923 or display the page using CEF4Delphi (
https://github.com/salvadordf/CEF4Delphi ) and retrieve the login
result.

----------------------------------------------------------------------
rvk · 2026-02-06 12:28

I'm not sure what you are trying to do.
If you look at the source... when you type in username and password
and submit, a small js is run and if entered correctly the page is
redirected to https://practicetestautomation.com/logged-in-
successfully.

So why not just directly load
https://practicetestautomation.com/logged-in-successfully ????
There is actually not a real login on that site, just a check for
username and password and a redirect.

If you have another REAL site, give us that URL so we can check its
login method.
Usually when doing a real login you need to investigate the cookies
and return values and pass that on to any other pages you retrieve.
(also for the missing CSRF token)
So you just taken a bad site as example for your login attempts (there
are a lot of different login methods used on the web).

Code: Javascript  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i <script>  
            document.addEventListener("DOMContentLoaded", function ()
{                        const username =
document.querySelector("#username"),                               
password = document.querySelector("#password"),                      
        submit = document.querySelector("#submit"),                  
            error = document.querySelector("#error");                
       submit.addEventListener("click", function () {                
              let us_name = username.value,                          
            us_pass = password.value;                                
if(us_name == "student" && us_pass == "Password123"){                
                      window.location.href =
"https://practicetestautomation.com/logged-in-successfully";         
                     }else if(us_name == "student" && us_pass !=
"Password123"){                                        error.innerHTML
= "Your password is invalid!";                                       
error.classList.add("show");                                       
username.value = "";                                       
password.value = "";                                }else{           
                           error.innerHTML = "Your username is
invalid!";                                       
error.classList.add("show");                                       
username.value = "";                                       
password.value = "";                                }                
      })                })        </script>

----------------------------------------------------------------------
Adie · 2026-02-06 12:59

Thanks
I was under the impression this webpage will allow testing of
'application' login. 

The test is now directly on the SAP S/4 HANA SITE.

In the meantime I did the following where I can 'retreive'  the
Cookies and use HTTP.FormPost(TargetURL, FormData, Response) to log
in.  I then get a "CSRF token is missing"  error.

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i  
InitSSLInterface;                                     // Initialize
SSL if using HTTPS  HTTP := TFPHTTPClient.Create(nil);  try    //
Enable redirects to maintain session    HTTP.AllowRedirect  := True; 
 HTTP.KeepConnection := True;     FormData := TStringList.Create;   
FormData.Values['sap-alias']    := Username;    FormData.Values['sap-
password'] := Password;    // Add any other required fields (e.g.,
anti-CSRF token if present)     try      Response :=
TStringStream.Create('');      try       
HTTP.Get('https://my430346-api.s4hana.cloud.sap');   // Get the
Cookies        ShowMessage( HTTP.ResponseHeaders.Text);        
cCookies.Text := HTTP.Cookies.Text;    // I protect the Cookies as the
'vanish' after POST        // Send the POST request       
HTTP.FormPost(TargetURL, FormData, Response);        // You can read
the response content from the Response stream if needed       
ShowMessage( 'Response ' + Response.DataString);      finally       
Response.Free;      end;    finally      FormData.Free;    end; 
finally    HTTP.Free;  end;  cCookies.Free; 
The following is the response I receive
Code: Text  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i *****
Header ***** content-type: text/html; charset=utf-8content-length:
8565sap-authenticated: falsecontent-security-policy: default-src
'self'sap-err-id: ICFLOGONREQUIREDexpires: 0pragma: no-cache, no-
store, privatecache-control: no-cache, no-store, privateorigin-agent-
cluster: ?0sap-server: truesap-perf-fesrec: 43239.000000set-cookie:
sap-login-XSRF_BVR=20260206095842-QHSUFNOq8JAd_lOsi2XbNQ%3d%3d;
path=/; secure; HttpOnly; SameSite=Noneset-cookie: sap-
usercontext=sap-client=100; path=/; SameSite=None; securex-content-
type-options: nosniffstrict-transport-security: max-age=31536000;
includeSubDomainsx-xss-protection: 1; mode=blocksap-passport-
component: none ***** Cookies *****sap-login-XSRF_BVR=20260206095842-
QHSUFNOq8JAd_lOsi2XbNQ%3d%3dpath=/secureHttpOnlySameSite=Nonesap-
usercontext=sap-client=100path=/SameSite=Nonesecure ****** Result
******{"error":{"code":"/IWBEP/CM_V4H_RUN/043","message":"CSRF token
is missing","@SAP__common.ExceptionCategory":"CSRF_Token_Missing"}} 
I am basically at the point where I think EITHER the cookie name is
WRONG based on the error
OR
The HTTP.FormPost(TargetURL, FormData, Response) is not sending the
cookie.

I also tried to include the Cookie in the HEADER but still no luck.

In the meantime I signed up to SAP in order to see if the Cookie
'name' is incorrect and ALSO ran an online test app to see what the
name on the webserver actually is.
Use this url 'https://my430346-api.s4hana.cloud.sap'   // Get the
Cookies directly via Brave .

At this point I want to test a site where the Cookie will 'work'

Thanks
Adie

----------------------------------------------------------------------
rvk · 2026-02-06 13:38

Quote from: Adie on February 06, 2026, 01:59:22 pmCode: Pascal
 [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i    
FormData := TStringList.Create;    FormData.Values['sap-alias']    :=
Username;    FormData.Values['sap-password'] := Password;    // Add
any other required fields (e.g., anti-CSRF token if present) So what
other FormData did you pass?????

When I press F12 in the browser and look at what actually is posted to
the "ui" page, it looks like this as FormData:

Quotesap-system-login-oninputprocessing=onLogin&sap-urlscheme=&sap-
system-login=basic_auth&sap-system-login-basic_auth=X&sap-
accessibility=&sap-login-
XSRF=D8gz0HSiHkoMVgkwfjLP5Lu_PxFqSmZTJ9imjvP2ggk%3D&sap-system-login-
cookie_disabled=&sap-hash=&sap-alias=test&sap-password=test&sap-
client=100&sap-language=NL
You only passes sap-alias and sap-password. But you also need to pass
sap-login-XSRF and maybe some of those others.
You need to test yourself which you are really required to pass.
But for example... that sap-login-XSRF... When you go to
my430346-api.s4hana.cloud.sap you are redirected to
my430346-api.s4hana.cloud.sap/ui
There you get a cookie with sap-login-XSRF_BVR with a value.
sap-login-XSRF_BVR=20260206132203-XVcdnafVmF9foR5v-b8ULw%3d%3d;
path=/; secure; HttpOnly; SameSite=None
You need to pass that value on in the FormData as seen in the example
above.
(although I'm not sure why they don't match for me... but try it
yourself... I don't have valid credentials.)

You can read about CXRF/XSRF here:
https://help.sap.com/docs/SAP_IDENTITY_MANAGEMENT/e56f59e67af440988337
19150c3ab8b7/5d0d3f157a1a4ee7b12d963251a21453.html?locale=en-US

BTW. Here you see some code how to login into SAP systems:
https://community.sap.com/t5/enterprise-resource-planning-blog-posts-
by-sap/how-to-login-to-an-sap-business-bydesign-system-with-
javascript/bc-p/13322954/highlight/true

You see that indeed only sap-alias, sap-password and sap-login-XSRF is
needed. So you are only missing that sap-login-XSRF.
You can see in the code there how to retrieve it.

----------------------------------------------------------------------
rvk · 2026-02-06 14:00

The XSRF you need to pass is even in the form data on the "ui" login
screen where you get redirected:

Code: Text  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i <div
id="LOGIN_SHADOW_FORM" hidden="hidden" class="loginDisplayNone">     
         <input type="hidden" name="sap-system-login-
oninputprocessing" value="onLogin">                <input
type="hidden" name="sap-urlscheme" value="">                <input
type="hidden" name="sap-system-login" value="basic_auth">            
  <input type="hidden" name="sap-system-login-basic_auth" value="X"> 
             <input type="hidden" name="sap-accessibility" value=""> 
             <input type="hidden" name="sap-login-XSRF"
value="uU_BXBVfacSVDa2qOwO3ZvtRDeelnYf4xhndySFYaHw&#x3d;">           
   <input type="hidden" name="sap-system-login-cookie_disabled"
value="">                <input type="hidden" name="sap-hash"
value="">                <div id="USERNAME_BLOCK" class="loginInput
sapUiLightestBG">                    <label id="USERNAME_LABEL"
for="USERNAME_FIELD-inner" class="loginHiddenAccessible"

----------------------------------------------------------------------
Adie · 2026-02-06 14:19

@rvk
**snip above**
I also tried to include the Cookie in the formdata but still no luck.

I even 'pasted' YOUR 'sap-login' in BOTH cookies and FormData and got
the same error.  I expected an error like 'INVALID' but not 'MISSING' 

I also CLEARED the TFPHTTPClient.Cookies  to prevent duplicates.

I also passed only the '20260206132203-XVcdnafVmF9foR5v-b8ULw%3d%3d'
portion or the WHOLE sentence still same issue.

I did notice that the %3d%3d are sometimes replaced with ==  I would
imagine that it would be WRONG not missing

** Reply on your post **
Line 7 now suddenly end with a ;
The name is now different again: sap-login-XSRF   instead of  sap-
login-XSRF_BVR


Thanks,

It is gonna be a busy weekend.

Adie

----------------------------------------------------------------------
rvk · 2026-02-06 14:23

The sap-login-XSRF_BVR is passed on as cookie (same as that you get
that cooke).
The sap-login-XSRF is a field that's in the ui login page you get
redirected to.
So you need to GET that ui page and extract the sap-login-XSRF value
and pass it in your FormData together with sap-alias and sap-password.

----------------------------------------------------------------------
Adie · 2026-02-07 12:21

**** ISSUE RESLOVED ****

The solution was simple: ONLY USE THE http.GET(...)


Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i procedure
TForm1.btnLoginClick(Sender: TObject);var  HTTP: TFPHTTPClient; 
Username : string;  Password : string;  TargetURL: string;  Get_URL  :
string;  cGetResult : string;   cSaveList: TStringlist;    // For Save
to TXT begin  TargetURL := 'https://xxxxx-
api.s4hana.cloud.sap/sap/opu/odata4/sap/........  Get_URL   :=
'https://xxxxx-api.s4hana.cloud.sap/ui';  Username  := 'MyUser'; 
Password  := 'MyPassw';   InitSSLInterface;                          
         // Initialize SSL if using HTTPS  HTTP :=
TFPHTTPClient.Create(nil);   // Enable redirects to maintain session 
HTTP.AllowRedirect  := True;  HTTP.KeepConnection := True;   // Load
the User Pass in GET  HTTP.UserName := Username;  
 //<=================== Give this to GET  HTTP.Password := Password;  
try    cGetResult :=  HTTP.Get(Get_URL);           // Log in to site 
 HtmlViewer1.LoadFromString( cGetResult ); // We need to test if Fail
to Log on          <<=========== TO DO     cGetResult :=
HTTP.Get(TargetURL);    HtmlViewer1.LoadFromString( cGetResult );  
//<<=========== display in 'Browser // Allow to Save result//cSaveList
     := TStringlist.Create;                      // we need to protect
the Cookies//cSaveList.Text := cGetResult;//cSaveList.SaveToFile(
'API_SalesOrders Active.TXT' );//cSaveList.Free;   finally   
HTTP.Free;  end;end;

----------------------------------------------------------------------
rvk · 2026-02-07 12:26

Quote from: Adie on February 07, 2026, 01:21:55 pm**** ISSUE RESLOVED
****

The solution was simple: ONLY USE THE http.GET(...)
In that case the API doesn't even need the sap-login-XSRF.
Just username:password@url is sufficient (which is what the Get()
internally does).

Only for faking (browser) user login via login page the sap-login-XSRF
is needed.

Glad you got it working