GradeSpeed (ParentStudentConnect)

Houston ISD uses GradeSpeed for their students to access their grades. Other districts may use the same software, so the base URL used in the writing of this documentation is below.

Base URL: apps.houstonisd.org/ParentStudentConnect/

Authentication

GET /

Situation 1

Request

Empty, cookie is null

Reponse

Status: 200 OK;

Set-Cookie header contains session id information.

ASP.NET_SessionId=zfstv242222wat45222falfb; path=/; HttpOnly

---

POST /login.aspx

Form data

The form data, as far as I can tell, isn't arbitrary and is generated by browser javascript and/or on the server-side and must be retrieved from the DOM directly. They're long and necessary for login to be successful.

ctl00$ContentArea$txtUserName → student username

ctl00$ContentArea$txtPassword → student password

ctl00$ContentArea$btnLogin → Login

__EVENTTARGET → (empty string)

__EVENTARGUMENT → (empty string)

__VIEWSTATE → /wEPD...8OI=

__VIEWSTATEGENERATOR → 125EDFF6

__PREVIOUSPAGE → NrX...cl0

__EVENTVALIDATION → /wEWC...SZ8=

Include Cookie data from / to proceed.

Situation 1

Request

Wrong credentials in form data

Reponse

Status: 200 OK;

Location header is empty/nonexistant to prevent redirection

Situation 2

Request

Correct credentials in form data

Reponse

Status: 302 Found;

Set-Cookie header contains valid .ASPXAUTH cookie and potentially others; Location header contains /ParentStudentConnect/default.aspx, redirecting you to the home page to see your grades

---

GET /PSCHome.aspx

Situation 1

Request

Cookie is invalid, by whatever means, and won't present you with a home page.

Reponse

Status: 302 Found;

Location header contains /ParentStudentConnect/login.aspx?ReturnUrl=%2fParentStudentConnect%2fPSCHome.aspx with the intent of having you login to continue.

Situation 2

Request

Cookie is valid from logging in previously.

Reponse

Status: 200 OK;

The response headers are completely uninteresting. You're in!