How to Authenticate HTTP requests with cookies from an embedded WebView2

By Tan Lee Published on Mar 07, 2025 126

Automating HTTP calls to web pages or APIs by bypassing Cloudflare Turnstile or other CAPTCHA systems can be achieved by using authentication cookies from a browser embedded in a Windows Forms application.

This article demonstrates how to extract cookies from a WebBrowser or WebView2 control and include them in the headers of an HttpRequestMessage in a Windows Forms app.

To implement this, we'll create a custom DelegatingHandler to interact with the WebBrowser or WebView2 control and fetch cookies:

Step 1: Create the Cookie Handler

We start by defining a custom DelegatingHandler that will be responsible for attaching cookies to the HTTP requests sent by the application.

For WebView2:

        
          
          
              
              internal sealed class WebView2SetCookieHandler : DelegatingHandler
{
    private readonly WebView2 _webView2;
 
    public WebView2SetCookieHandler(WebView2 webView2, HttpMessageHandler innerHandler)
        : base(innerHandler)
    {
        _webView2 = webView2;
    }
 
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        if (request.RequestUri != null)
        {
            var cookieHeader = await this.GetCookieHeaderAsync(request.RequestUri).ConfigureAwait(false);
 
            if (!string.IsNullOrEmpty(cookieHeader))
            {
                request.Headers.Add("Cookie", cookieHeader);
            }
        }
 
        return await base.SendAsync(request, cancellationToken).ConfigureAwait(false);
    }
 
    private async Task<string> GetCookieHeaderAsync(Uri uri)
    {
        CookieContainer cookieContainer;
 
        if (_webView2.CheckAccess())
        {
            cookieContainer = await this.GetCookieContainerAsync(uri).ConfigureAwait(false);
        }
        else
        {
            var cookieContainerTask = _webView2.Dispatcher.InvokeAsync(() => this.GetCookieContainerAsync(uri)).Task.Unwrap();
            cookieContainer = await cookieContainerTask.ConfigureAwait(false);
        }
 
        return cookieContainer.GetCookieHeader(uri);
    }
 
    private async Task<CookieContainer> GetCookieContainerAsync(Uri uri)
    {
        var cookies = await _webView2.CoreWebView2.CookieManager.GetCookiesAsync(uri.ToString()).ConfigureAwait(false);
        var cookieContainer = new CookieContainer();
 
        foreach (var cookie in cookies)
        {
            cookieContainer.Add(cookie.ToSystemNetCookie());
        }
 
        return cookieContainer;
    }
}

            

        
      

For WebBrowser control:

        
          
          
              
              internal sealed class WebBrowserSetCookieHandler : DelegatingHandler
{
    private readonly WebBrowser _webBrowser;
 
    public WebBrowserSetCookieHandler(WebBrowser webBrowser, HttpMessageHandler innerHandler)
        : base(innerHandler)
    {
        _webBrowser = webBrowser;
    }
 
    protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
    {
        if (request.RequestUri != null)
        {
            var cookieHeader = await this.GetCookieHeaderAsync(request.RequestUri).ConfigureAwait(false);
 
            if (!string.IsNullOrEmpty(cookieHeader))
            {
                request.Headers.Add("Cookie", cookieHeader);
            }
        }
 
        return await base.SendAsync(request, cancellationToken).ConfigureAwait(false);
    }
 
    private async Task<string> GetCookieHeaderAsync(Uri uri)
    {
        CookieContainer cookieContainer;
 
        if (_webBrowser.InvokeRequired)
        {
            cookieContainer = await Task.Run(() => this.GetCookieContainerAsync(uri)).ConfigureAwait(false);
        }
        else
        {
            cookieContainer = this.GetCookieContainerAsync(uri);
        }
 
        return cookieContainer.GetCookieHeader(uri);
    }
 
    private CookieContainer GetCookieContainerAsync(Uri uri)
    {
        var cookies = _webBrowser.Document.Cookie;  // Access the cookies from WebBrowser control
        var cookieContainer = new CookieContainer();
 
        // Assuming cookies are in a simple format for this example
        var cookieCollection = ParseCookies(cookies);
        foreach (var cookie in cookieCollection)
        {
            cookieContainer.Add(cookie);
        }
 
        return cookieContainer;
    }
 
    private IEnumerable<Cookie> ParseCookies(string cookies)
    {
        // Parse cookies into a collection of Cookie objects.
        // This step assumes a simple cookie format, customization may be required based on the actual data.
        var cookieList = new List<Cookie>();
        var cookieParts = cookies.Split(';');
 
        foreach (var cookie in cookieParts)
        {
            var parts = cookie.Split('=');
            if (parts.Length == 2)
            {
                cookieList.Add(new Cookie(parts[0].Trim(), parts[1].Trim()));
            }
        }
 
        return cookieList;
    }
}

            

        
      

Step 2: Integrate the Cookie Handler into the HTTP Client

Now, you need to integrate the WebView2SetCookieHandler into your HTTP client.

        
              internal partial class MainForm : Form
{
    private readonly HttpClient _httpClient;
 
    public MainForm()
    {
        InitializeComponent();
 
        // Initialize WebView2
        MyWebView2.EnsureCoreWebView2Async().ContinueWith(task =>
        {
            var setCookieHandler = new WebView2SetCookieHandler(MyWebView2, new HttpClientHandler());
            _httpClient = new HttpClient(setCookieHandler);
        }, TaskScheduler.FromCurrentSynchronizationContext());
    }
}

For WebBrowser control:

        
              internal sealed partial class MainForm : Form
{
    private readonly HttpClient _httpClient;
 
    public MainForm()
    {
        InitializeComponent();
 
        var setCookieHandler = new WebBrowserSetCookieHandler(this.MyWebBrowser, new HttpClientHandler());
        this._httpClient = new HttpClient(setCookieHandler);
    }
}

Step 3: Ensure the WebBrowser or WebView2 Control is Ready

Before you can access cookies, you need to ensure that the WebView2 control has been properly initialized. You can use the EnsureCoreWebView2Async method for this.

        
              private async void MyWebView2_CoreWebView2Initialized(object sender, EventArgs e)
{
    // Make sure WebView2 is initialized
    await MyWebView2.EnsureCoreWebView2Async();
     
    // Now you can use WebView2SetCookieHandler in the HTTP client
    var setCookieHandler = new WebView2SetCookieHandler(MyWebView2, new HttpClientHandler());
    _httpClient = new HttpClient(setCookieHandler);
}

Just like WebView2, the WebBrowser control in Windows Forms requires some initialization before you can access its Document and cookies. You'll need to ensure the DocumentCompleted event is triggered before you attempt to read cookies.

        
              private void MyWebBrowser_DocumentCompleted(object sender, WebBrowserDocumentCompletedEventArgs e)
{
    // This ensures that the document is fully loaded before interacting with it.
    var handler = new WebBrowserSetCookieHandler(this.MyWebBrowser, new HttpClientHandler());
    _httpClient = new HttpClient(handler);
}

Step 4: Making an HTTP Request

Once the HttpClient is set up with the WebView2SetCookieHandler, you can now make HTTP requests that will automatically include the cookies from your WebView2 browser control.

public async Task MakeAuthenticatedRequest()
{
    var response = await _httpClient.GetAsync("https://example.com/protected-resource");
    var content = await response.Content.ReadAsStringAsync();
    Console.WriteLine(content);
}

Now that we have set up the custom handler with the WebBrowser control's cookies, you can make HTTP requests as usual. The cookies will automatically be included in the request headers.

public async Task MakeAuthenticatedRequest()
{
    var response = await _httpClient.GetAsync("https://example.com/protected-resource");
    var content = await response.Content.ReadAsStringAsync();
    Console.WriteLine(content);
}

This example demonstrates how to use a WebBrowser or WebView2 control in a Windows Forms application to extract cookies for making authenticated HTTP requests. By using a DelegatingHandler, we are able to append these cookies to the headers of outgoing HTTP requests, bypassing restrictions like CAPTCHA systems in some scenarios.

How to Authenticate HTTP requests with cookies from an embedded WebView2

By Tan Lee Published on Mar 07, 2025 126

Related

Categories

Popular Posts

Entity Framework Code First vs Database First vs Model First Approach

RuangAdmin Template

How to secure ASP.NET Core with NWebSec

HTML Bootstrap 4 Login, Register & Reset Template

Carpatin Admin Dashboard Template