request-fest

GET-to-POST form bridge for ASP.NET WebForms endpoints. Point it at a results page, and it fetches the page's hidden inputs (__VIEWSTATE, __EVENTVALIDATION, …), echoes your query parameters as form fields, and auto-submits the POST — like the classic "request fest" trick for webforms that need a POST with a full viewstate.

Ported from Ruby (WEBrick + Nokogiri) to Node.js 24 (ESM, zero-framework).

Usage

GET /api?autosubmit=0&fetchhidden=1&action=<urlencoded target>&ctl00$edtSearch=bellville&...

Param	Meaning
action	(required) URL-encoded target URL the generated form POSTs to
fetchhidden	1 = fetch the target page and include its hidden inputs in the form
autosubmit	omit or 1 = form auto-submits via JS; 0 = render a visible form

Any other parameter is echoed into the form as a field (the field name is the parameter name, so ASP.NET names like ctl00$Content_Main$edtSearch work verbatim).

• GET → visible text inputs, auto-submit by default
• POST → hidden inputs, always auto-submit
• GET / → usage page (served from public/ on Vercel; same locally)

Local dev

fnm use            # Node 24 (see .node-version)
npm install
npm test           # node:test suite
npm start          # http://localhost:3000 (falls back to the next free port)

Note: port 3000 on this machine is owned by the Hermes WhatsApp bridge, so npm start typically reports http://localhost:3001.

Deploy (Vercel)

The repo root is a Vercel project: api/index.js is the serverless function and public/ serves the root usage page. vercel.json pins the function to the nodejs24.x runtime (30s max duration), runs in fra1 (Frankfurt, closest to SA), and adds nosniff + no-referrer headers to /api — the latter stops the target site from seeing the request-fest URL as a referrer.

Push to GitHub and import the repo on Vercel, or npx vercel from the root.

Behaviour notes vs the Ruby original

• autosubmit=1 now actually enables auto-submit. The Ruby original had a precedence bug (a = x or y parses as (a = x) or y) that made an explicit autosubmit=1 a no-op; only an absent parameter auto-submitted. Intended semantics are preserved here.
• The generated page is a full styled document: labeled fields, textareas for long values (ViewState blobs), harvested hidden inputs grouped under a collapsible "Hidden inputs from target" block, control params in a meta line, and a spinner status page when auto-submitting.
• A failure to fetch hidden inputs renders a warning banner instead of submitting the error hash (class/error/backtrace) as form fields.
• Sanitisation is done by strict HTML-escaping of every interpolated value (equivalent to Sanitize.fragment in the output role).