import urllib.request, urllib.error, ssl

BASE = "http://sso.yunhaixingtong.com"
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE

def req(method, path, data=None, headers=None):
    url = BASE + path
    h = headers or {}
    r = urllib.request.Request(url, data=data, method=method, headers=h)
    try:
        resp = urllib.request.urlopen(r, timeout=20, context=ctx)
        body = resp.read().decode('utf-8', 'ignore')
        return resp.status, dict(resp.getheaders()), body
    except urllib.error.HTTPError as e:
        body = e.read().decode('utf-8', 'ignore')
        return e.code, dict(e.headers), body

print("=== 1) /front/index.html WITHOUT auth (is it behind CAS?) ===")
st, hd, body = req("GET", "/front/index.html")
print("status:", st, "| Location:", hd.get("Location"))
print("body has /cas/login:", "/cas/login" in body, "| ?v=1.7:", "v=1.7" in body,
      "| action=/api/login:", 'action="/api/login"' in body, "| name=username:", 'name="username"' in body)

print("\n=== 2) POST /api/login BOGUS (native form, no XHR header) ===")
form = "loginname=AAA&pwd=BBB&captcha=".encode()
st, hd, body = req("POST", "/api/login", data=form, headers={"Content-Type":"application/x-www-form-urlencoded"})
print("status:", st, "| Location:", hd.get("Location"))

print("\n=== 3) POST /api/login BOGUS (AJAX X-Requested-With) ===")
st, hd, body = req("POST", "/api/login", data=form, headers={"Content-Type":"application/x-www-form-urlencoded","X-Requested-With":"XMLHttpRequest"})
print("status:", st, "| body[:180]:", body[:180])

print("\n=== 4) /api/public-key ===")
st, hd, body = req("GET", "/api/public-key")
print("status:", st, "| body[:160]:", body[:160])