Skip to content

Cross-site remote form redirect

This is the only operation exposed by SAIF.Services.Web. It gives an ASP.NET page or handler a way to forward the current user's browser, together with a set of POST-body name/value parameters, to another URL — for example a payment gateway or another SAIF web application — where a plain HTTP redirect (a GET) cannot carry the required data. The class accumulates the caller's inputs, writes a minimal self-submitting HTML <form> directly to the current response, and ends the response so the browser executes the auto-submit and issues the outbound POST.

Field Value
Operation ID OP-SW-01
Trigger Caller instantiates RemotePost, sets URL, calls AddInput for each parameter, optionally sets FormName, then calls Post()
Inputs Target URL (string), one or more Name/Value pairs added via AddInput, optional FormName (defaults to "form1")
Outputs An HTML response written to the current ASP.NET response containing a hidden <form> that auto-submits via a <body onload> handler; the current response is cleared and ended as part of this operation
Primary components RemotePost (AddInput, URL, FormName, Post)
Entry point Services\SAIF.Services.Web\RemotePost.vb

Steps

  1. Caller instantiates RemotePost. The instance starts with an empty internal NameValueCollection of inputs and a default FormName of "form1".
  2. Caller sets the URL property to the destination address that the auto-submitted form will POST to.
  3. If URL is never set, it remains Nothing/empty, and the generated form's action attribute is written as an empty string, causing the browser to POST back to the current page instead of an external target.*
  4. Caller calls AddInput(Name, Value) once for each parameter to be sent as a hidden form field. Each call adds an entry to the internal NameValueCollection; the collection allows duplicate Name keys, so calling AddInput twice with the same name accumulates rather than replaces the value.*
  5. Caller optionally sets FormName to override the default "form1", which changes both the form's name attribute and the document.<FormName>.submit() call emitted in the onload handler.
  6. Caller calls Post(), which performs the remainder of this operation against HttpContext.Current.
  7. On failure: if Post() executes outside an active ASP.NET web request (i.e., HttpContext.Current is null), a NullReferenceException occurs when the method dereferences HttpContext.Current.Response.*
  8. Post() calls HttpContext.Current.Response.Clear(), discarding any response content buffered before this call.
  9. Post() writes the opening <html><head> markup, then closes the head and opens <body> with an onload="document.<FormName>.submit()" attribute.
  10. Post() writes a <form> element with name="<FormName>", method="post", and action="<URL>".
  11. Post() iterates every key in the internal inputs collection and writes one hidden <input name="<Key>" type="hidden" value="<Value>"> element per entry, in the collection's enumeration order.
  12. Caller-supplied Name and Value strings are written directly into the HTML attribute values via String.Format with no HTML-encoding; values containing quote characters or HTML-significant characters can produce malformed markup or, if the values originate from untrusted input, enable HTML/script injection.*
  13. Post() writes the closing </form> and </body></html> tags.
  14. Post() calls HttpContext.Current.Response.End(), which flushes the written HTML to the client and terminates further processing of the current request.
  15. The browser receives the HTML page; because scripting is enabled, the <body onload> handler fires and submits the form, issuing an HTTP POST containing all registered name/value pairs to the target URL.
    • If the browser has JavaScript disabled, the onload handler never fires and the auto-submit does not occur, leaving the user on the intermediate blank page with no visible fallback submit control.*

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller constructs RemotePost]) --> SetUrl[Set URL property]
    SetUrl --> AddInputs[Call AddInput for<br>each name/value pair]
    AddInputs --> OptFormName{Override<br>FormName?}
    OptFormName -->|Yes| SetFormName[Set FormName property]
    OptFormName -->|No| CallPost[Call Post]
    SetFormName --> CallPost
    CallPost --> HasContext{HttpContext.Current<br>available?}
    HasContext -->|No| Err([NullReferenceException])
    HasContext -->|Yes| Clear[Response.Clear]
    Clear --> Write[Write hidden form with<br>one input per name/value pair]
    Write --> End[Response.End]
    End --> Browser[Browser receives HTML]
    Browser --> JsCheck{JavaScript<br>enabled?}
    JsCheck -->|Yes| AutoSubmit([onload fires;<br>browser POSTs to target URL])
    JsCheck -->|No| Stuck([Form never submits;<br>user stuck on blank page])

Failure and edge-case behavior

  • If Post() is called outside an active ASP.NET web request context (i.e., HttpContext.Current is null), a NullReferenceException occurs at runtime.*
  • If URL is not set before calling Post(), the generated form targets an empty action attribute, causing the browser to POST back to the current page rather than an external target.*
  • Caller-supplied Name/Value pairs are written directly into HTML <input> attribute values without HTML-encoding; values containing HTML-special characters may produce malformed markup or enable injection if untrusted input is passed.*
  • Duplicate AddInput calls with the same Name accumulate multiple values under that key in the underlying NameValueCollection rather than overwriting the prior value, and all are written as separate hidden inputs with the same name attribute.*
  • If the browser has JavaScript disabled, the onload auto-submit never fires and the request is never forwarded to the target URL, with no visible fallback for the user.*
  • Response.End() terminates the current request pipeline; any code after the Post() call in the caller's page lifecycle does not execute for the current request.*

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts.

Sources

  • Services\SAIF.Services.Web\RemotePost.vb