ASP.NET login using VBA via ServerXMLHTTP - new sign in notification and security que stion - asp.net

Question

I have VBA code which allows me to successfully submit my login credentials via POST method. Unfortunately the website uses security questions whenever a different login pattern is detected and the question appears in POST request response text, also I receive email notification about new sign in. I had the security questions before, while using manual logins, after logging through different browser or clearing cache.
I guessed that cookies could be the solution, but when I used:
.sendRequestHeader "Cookie", myCookieString
with the same cookie string which is sent via manual login POST request, I also received 200 status response. What can I do to login directly, so that no security questions are asked?
Also, are "Cache-Control", "Pragma" and "User-Agent" RequestHeaders any use in my code?
Option Explicit
Sub GuruLogin()
Dim viewStateGen As String, viewState As String
Dim htmlDoc As New HTMLDocument
Dim allParams As Variant 'string generates invalid parameter error
Dim serverXMLHTTP As Object 'XMLHTTP causes access denied error on .send
Set serverXMLHTTP = CreateObject("MSXML2.serverXMLHTTP")
With serverXMLHTTP
.Open "GET", "https://www.guru.com/login.aspx", False
.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
.setRequestHeader "Cache-Control", "no-cache"
.setRequestHeader "Pragma", "no-cache"
.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0"
.send
htmlDoc.body.innerHTML = .responseText
With htmlDoc
viewStateGen = .getElementById("__VIEWSTATEGENERATOR").Value
viewState = EncodeURL(.getElementById("__VIEWSTATE").Value)
End With
End With
With serverXMLHTTP
.Open "POST", "https://www.guru.com/login.aspx", False
.setRequestHeader "Content-type", "application/x-www-form-urlencoded"
.setRequestHeader "Cache-Control", "no-cache"
.setRequestHeader "Pragma", "no-cache"
.setRequestHeader "User-Agent", "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0"
allParams = "ctl00_scriptMgr_HiddenField=&__LASTFOCUS=&__EVENTTARGET=&__EVENTARGUMENT=&" & _
"__VIEWSTATE=" & viewState & "&__VIEWSTATEGENERATOR=" & viewStateGen & "&ctl00%24scriptMgr=&" & _
"ctl00%24ContentPlaceHolder1%24ucLogin%24txtUserName%24txtUserName_TextBox=mygmailname%40gmail.com&" & _
"ctl00%24ContentPlaceHolder1%24ucLogin%24txtPassword%24txtPassword_TextBox=mygurupassword&" & _
"ctl00%24ContentPlaceHolder1%24btnLoginAccount%24btnLoginAccount_Button=Sign+In&" & _
"ctl00%24ContentPlaceHolder1%24hdnLinkedInClntID=77aj4w1f86tc9b&" & _
"ctl00%24ContentPlaceHolder1%24hdnGooglePlusClntID=130090623010-1785qcncrqfi1uv1ge0btt8nspiv2spj.apps.googleusercontent.com&" & _
"ctl00%24ContentPlaceHolder1%24hdnFacebookClntID=797387497025842&" & _
"ctl00%24hdnGuid=GUID"
.send allParams
If .Status <> 302 Then Debug.Print "login error, status " & .Status '302 = redirect (success), 200 = login error
End With
End Sub
Function used to properly encode viewState string:
Public Function EncodeURL(inputURL As String) As String 'in Excel 2013+ there is WorksheetFunction.EncodeUrl(InputString)
Static EncoderScriptEngine As Object
If EncoderScriptEngine Is Nothing Then Set EncoderScriptEngine = CreateObject("ScriptControl")
With EncoderScriptEngine
.Language = "JScript"
EncodeURL = .Run("encodeURIComponent", inputURL)
End With
End Function

Answer 1

I have solved this issue, it was quite trivial.
I followed the advice in similar threads and installed a free tool called Telerik Fiddler to troubleshoot requests. To make my requests from macros be visible for this program, I had to use this line:
WinHttp.setProxy 2, "127.0.0.1:8888" 'make the request be detected by Fiddler
If you want to see requests from Firefox or avoid https site security alerts when Fiddler is on, follow great tutorials on developer's website.
By comparing manual login requests and automated ones, my obvious mistake has shown:
Security answer page was the result of POST redirecting me to the main page automatically, what means without response cookie. Lack of this cookie caused the next redirect - to security question page. I'll need to disable auto redirects, get the response cookie from POST and send GET request to the main page.