Tried programatically logging into a website using C# .NET Framework but it just returns the login page

Submitting a html form, needs to protect against a number of different attacks that could be performed in javascript while you are browsing other web sites. Any form should include a code unique to your request, that you have to include when you submit the form again. Otherwise anyone would be able to post a new facebook status, a new tweet, transfer funds from your bank account, ... etc.

Here's something similar that I've written before. The basic idea is to fetch the login form, parse it with Html Agility Pack, fill in values we know about, then submit it;

// ...
var handler = new HttpClientHandler {
    AllowAutoRedirect = false,
    CookieContainer = new CookieContainer()
};

var client = new HttpClient(handler);
client.BaseAddress = new Uri("...");
// ...

private async Task Login(string username, string password)
{
    var response = await client.GetAsync("/Account/Login", HttpCompletionOption.ResponseHeadersRead);

    // if the server thinks we are already logged in
    if (response.StatusCode == HttpStatusCode.Found
        && response.Headers.Location.ToString().Contains("/Dashboard/Welcome"))
        return;

    if (response.StatusCode!=HttpStatusCode.OK)
        throw new Exception($"Login failed (GET /Account/Login returned {response.StatusCode})");

    var doc = new HtmlDocument();
    doc.LoadHtml(await response.Content.ReadAsStringAsync());
    var forms = doc.DocumentNode.Descendants("form");
    foreach(var form in forms)
    {
        var action = form.Attributes["action"].Value;
        // identify the correct form based on where the action posts to
        if (!action.StartsWith("/Account/Login"))
            continue;

        // find all inputs, visible or hidden
        var values = new Dictionary<string, string>();
        var inputs = form.SelectNodes("//input[@name]");
        foreach(var input in inputs)
        {
            var name = input.Attributes["name"]?.Value;
            if (string.IsNullOrWhiteSpace(name))
                continue;
            var value = input.Attributes["value"]?.Value;

            // substitute required values we know about
            if (name.ToLowerInvariant().Contains("username"))
                value = username;
            else if (name.ToLowerInvariant().Contains("password"))
                value = password;

            if (!string.IsNullOrWhiteSpace(value))
                values[name] = value;
        }

        // submit the form
        var loginResponse = await client.PostAsync(action, new FormUrlEncodedContent(values));
        if (loginResponse.StatusCode != HttpStatusCode.Found)
            throw new Exception($"Login failed (POST {action} returned {loginResponse.StatusCode})");

        return;
    }
    throw new Exception("Login failed");
}

The above could be generalised to submit any basic html form of any web site. This is not fool-proof, a web site could be doing something else with javascript in order to login.

I'm a .Net guy but I happen to have the Python code to illustrate what issue I think you're facing. This example logs into the Microsoft Certification portal. The problem I hit was the Microsoft Certification portal has a __RequestVerificationToken and this is what @JeremyLakeman was talking about with submitting a form.

Python:

with requests.Session() as session:        
    page = session.get('https://mcp.microsoft.com/Anonymous/transcript/validate', verify=False)
    soup = BeautifulSoup(page._content, 'html.parser')
    
    payload = {
        'transcriptId': '725151', 
        'accessCode': 'jeremythompson'
        }

    requestToken = ''
    hidden_tags = soup.find_all("input", type="hidden")
    for tag in hidden_tags:
        if tag.attrs["name"] == '__RequestVerificationToken':
            requestToken = tag.attrs["value"]
            break

    payload['__RequestVerificationToken'] = requestToken

    page = session.post('https://mcp.microsoft.com/anonymous/transcript/validate', data=payload)

See how I look for the hidden __RequestVerificationToken input and then pass it back in the payload.

C#:

var client = new HttpClient();

var values = new Dictionary<string, string>
{
    { "username", "[email protected]" },
    { "password", "pass1234" }
};

var requestToken = "";
var inputs = form.SelectNodes("//input[@name]");
foreach(var input in inputs)
{
     if (input.attrs["name"] == "__RequestVerificationToken") {
        requestToken = input.attrs["value"];
        break;
     }
}

values.Add("__RequestVerificationToken", requestToken);
var content = new FormUrlEncodedContent(values);
var response = await client.PostAsync("https://www.website.com/Portal/open/Logon.aspx", content);

var responseString = await response.Content.ReadAsStringAsync();
Console.WriteLine(responseString);