How to login to web application(ex.Django )?

Questions & Answers
1

Hi there

I’d like to login to Web sytem like Django.

My Unity’s C# is this.

private IEnumerator RunLogin (string url)
{
    // using POST
    WWWForm form = new WWWForm ();
    // csrf token
    form.AddField ("csrfmiddlewaretoken", csrfToken);
    string loginUsername = usernameField.text;
    form.AddField ("username", loginUsername);
    form.AddField ("password", passField.text);

    // HEADER
    Dictionary<string, string> headers = new Dictionary<string, string> ();
    headers.Add ("Cookie", cookie_value);
    byte[] rawData = form.data;

    WWW www = new WWW (url, rawData, this.hsHeader);
    yield return www;

    if (www.error == null)
    {
        Debug.Log ("OK");
    }
    else
    {
        Debug.Log ("BAD");
    }
}

And cookie_value and csrfToken is here

    string cookie = "";
    foreach (KeyValuePair<string, string> kv in www.responseHeaders)
    {
        if (kv.Key == "SET-COOKIE")
        {
            cookie = kv.Value;
        }
    }
    cookie_value = cookie;

    // json
    JsonData data = JsonMapper.ToObject (jsonText);

    bool isSuccess = false;
    try
    {
        csrfToken = (string)data ["csrf_token"];
        isSuccess = true;
        Debug.Log (csrfToken);
    }

But, I can’t login.
Error is this.

You are trying to load data from a www stream which had the following error when downloading.
403 FORBIDDEN
UnityEngine.WWW:get_text()
<RunLogin>c__Iterator8:MoveNext() (at Assets/Scripts/AvatarSystem/LoginSystem.cs:267)

Could you tell me how to login it?

2

As this is an old question, I assume you have figured this out on your own.
For anyone else who comes across this…

The Django csrf token stands for cross site request forgery (Cross Site Request Forgery protection | Django documentation | Django)
It exists to prevent login attempts coming from outside of your Django application. This is an important security feature that you can read about in the above link. Because of this, you can’t just create a form elsewhere on the internet and POST it to your Django application.

Even if you could, there are a couple of other problems I see here. You have created a security risk for your users by sending their username/password in the clear. Also, WWW by default will do a GET request to the URL. You would have to do a POST.
See this for posting a form - Unity - Scripting API: WWWForm