# Why won't this Ruby/Mechanize HTTP POST work? (the Bank's web server gives Session Timeout response

**URL:** <https://www.ruby-forum.com/t/why-wont-this-ruby-mechanize-http-post-work-the-banks-web-server-gives-session-timeout-response/174599>\
**Category:** Rails\
**Created:** [August 29, 2009, 12:55pm UTC](https://www.ruby-forum.com/t/why-wont-this-ruby-mechanize-http-post-work-the-banks-web-server-gives-session-timeout-response/174599 "2009-08-29T12:55:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![greg](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/71c47a/32.png) [@greg](https://www.ruby-forum.com/u/greg)\
**Post date:** [August 29, 2009, 12:55pm UTC](https://www.ruby-forum.com/t/why-wont-this-ruby-mechanize-http-post-work-the-banks-web-server-gives-session-timeout-response/174599/1 "2009-08-29T12:55:31Z")

</div>

Hi,

A question for the web/http guru’s out there if I may (who understand  
cookies, sessions ids, etc).

# BACKGROUND:

I’m writing some Ruby code (using Mechanize) to automate logging into  
my bank account to check the balance. The first step after I  
successfully log and click on a button am getting “You Session Has  
Ended”! I’ve simulated using the bank account on my browser manually  
without Javascript enabled so this shouldn’t be an issue (I note that  
someone posted Mechanize doesn’t support javascript). I’m wondering  
what it could possibly be & what tools/approach I could you to prove  
the request from Ruby/Mechanize exactly matches the succesful post  
that occurs when I log in through my browser.

# QUESTIONS:

Q1 - Based on the below can someone see why I am getting a “You  
Session Has Ended”? (e.g. it it something to do with  
SessionId/cookies/full post paremeters being in place). Some ideas,  
however not sure if they are significant:  
(a) I had to do some work arounds as Mechanize didn’t seem to be  
creating a valid URI re the first part of the URL, hence I hand  
modified it. I think it should be OK? It the line in the code  
“continue\_form.action = “[https://banking2.anz.com/IBAU/](https://banking2.anz.com/IBAU/)” +  
continue\_form.action”  
(b) The form itself (see below) actually doesn’t have a SUBMIT button  
but has a "INPUT TYPE=“Image” tag. Mechanize doesn’t seem to pick  
this up, but when I do mechanize “submit” via the code “page =  
agent.submit(continue\_form)” it still seems to initiate a POST to the  
server, albeit the response that comes back says the session has  
expired. I note there are some missing parameters in the browser  
trace versus the Ruby/Mechanize trace (see below), but would this  
cause a “session is no longer valid”? (I tried to manually add fields  
to compensate into the form via the code  
“continue\_form.add\_field!(“Action.RetUser.SignonOK”,“Proceed to  
Internet Banking”)” however it didn’t seem to trigger them to be  
included)

Q2 - What tool can I use on both the Browser & my Ruby/Mechanize code  
to compare the exact POSTs and see where the differences are? I can  
do Live HTTP Headers in firefox for the browser test (which works),  
but in Ruby/Mechanize I think I’m stuck with it’s logging. I can’t  
run WireShark as the traffic is HTTPS and encrypted. Any ideas?

Q3 - If the exact issues isn’t obvious any suggestions/ideas re what to  
try?

# FURTHER BACKGROUND:

- Successful Trace - manually via browser - using HTTP Live Headers  
plugin for Firefox (I’ve shorted session key for succintness)  
POST /IBAU/BANKAWAYTRAN;jsessionid=xxx  
Action.RetUser.SignonOK.x=39&Action.RetUser.SignonOK.y=12&Action.RetUser.SignonOK=Proceed+to+Internet+Banking

- Unsuccessful Trace - i.e. What I see in the Ruby/Mechanize log file  
Net::HTTP::Post: /IBAU/BANKAWAYTRAN;jsessionid=xxx

- Guts of the Form I’m simulating the response for:

- My Ruby/Mechanize Code

* * *

require ‘rubygems’  
require ‘mechanize’  
require ‘mechanize\_extns/form\_extn.rb’  
require ‘logger’

agent = WWW::Mechanize.new{|a| a.log = Logger.new(STDERR) }

# Step 1 - Navigate to Login Page

page = agent.get(‘[Login - ANZ Internet Banking](https://www.anz.com/INETBANK/login.asp)’)  
if !page.forms[1] || (page.forms[1].name != “loginForm”)  
puts “ERROR: At login form validation failed”  
exit  
end

# Step 2 - Login

login\_form = page.forms[1]  
login\_form.CorporateSignonCorpId = “xxxx”  
login\_form.CorporateSignonPassword = “yyyy”  
page = agent.submit(login\_form)  
if !page.forms[0] || (page.forms[0].name != “securityForm”)  
puts “ERROR: At clicking on continue button after login”  
exit  
end

# Step 3 - Click Continue to Main Page (\*\* WHERE ISSUE OCCURS \*\*)

continue\_form = page.forms[0]

# work around 1 - the bank’s input tage of type image does not seem to

get handled, so add a button in  
continue\_form.add\_field!(“Action.RetUser.SignonOK”,“Proceed to  
Internet Banking”) # Don’t see effect of this in log trace?  
continue\_form.add\_field!(“Action.RetUser.SignonOK.x”,“23”)  
# Don’t see effect of this in log trace?  
continue\_form.add\_field!(“Action.RetUser.SignonOK.y”,“7”)  
# Don’t see effect of this in log trace?

# work around 2 - the relative URI in the bank form’s action does not

seem to get handled, so add the front part on  
continue\_form.action = “[https://banking2.anz.com/IBAU/](https://banking2.anz.com/IBAU/)” +  
continue\_form.action  
page = agent.submit(continue\_form)  
if !page.forms[1] || (page.forms[1].name != “formAll1”)  
puts “ERROR: At clicking on continue button after login  
==================================” # \<== FAILED HERE WITH SESSION  
ENDED IN REPONSE  
puts page.content  
puts “ERROR: At clicking on continue button after login  
==================================”  
exit  
end

# Step Final - Logout

## puts “Completed!”

Any other info that would help you out helping me out?

thanks