How to use HttpSendRequestEx with password-protected URLs

This article was previously published under Q194700
This article has been archived. It is offered "as is" and will no longer be updated.
You can use HttpSendRequestEx to send requests to a password-protected URL.This article outlines the different techniques you can use.
This is the usual sequence of APIs used with HttpSendRequest:
   InternetConnect ()   HttpOpenRequest ()   HttpSendRequestEx ()   HttpEndRequest ()				

Method 1

If the user name and password are known before sending the request (thatis, they don't have to be dynamically entered by the user), then user nameand password can be supplied directly to the InternetConnect API. However,unlike HttpSendRequest, HttpSendRequestEx will not resubmit a request onits own after receiving the "401 Access Denied" status code from theserver. Therefore, HttpEndRequest will fail with anERROR_INTERNET_FORCE_RETRY error. This error message from HttpEndRequestindicates that the application must go back to HttpSendRequestEx and send all the buffers with InternetWriteFile again.

Method 2

If it is not possible to supply credentials in the InternetConnect API, thenyou must use the following steps:
  1. Similarly to HttpSendRequest, the status code of the request may be determined by calling HttpQueryInfo (hRequest, HTTP_QUERY_STATUS_CODE | HTTP_QUERY_FLAG). With HttpSendRequestEx, HttpQueryInfo must be called after HttpEndRequest, not after HttpSendRequestEx.
  2. Valid credentials can be entered either with InternetErrorDlg() or by calling InternetSetOption with INTERNET_OPTION_USERNAME and INTERNET_OPTION_PASSWORD options.
  3. Similarly to method 1, the application should go back toHttpSendRequestEx.

Both of the methods above have a serious drawback: Because HttpSendRequestEx isused to send large amounts of data, resubmitting the entire data uponreceiving the ERROR_INTERNET_FORCE_RETRY error or the 401 status code maywaste network bandwidth and time. Method 3 is the preferred method ofhandling user authentication with HttpSendRequestEx:

Method 3

This method involves sending an auxiliary request for the URL viaHttpSendRequest. Note that HttpSendRequestEx should be called on the same handle as HttpSendRequest. This will ensure that the request sent by HttpSendRequestEx will be sent over the connection authenticated by the first call to HttpSendRequest. Reusing the connection (using "Keep-Alive" connection) is necessary for NTLM (NT LAN manager authentication) support. To preserve bandwidth and time, neither request nor reply should have large amounts of data. The best way to accomplish this is to send the same type of request with HttpSendRequest as HttpSendRequestEx, but with the 0 content length.

The following steps show how to use an auxiliary request. It assumes that large amounts of data need to be POSTed to /Scripts/Poster.exe URL:
 hOpen = InternetOpen (...) hConnect = InternetConnect (hOpen, ...) // Note INTERNET_FLAG_KEEP_CONNECTION flag needed for NTLM hRequest = HttpOpenRequest (hConnect, "POST",                             "/scripts/poster.exe",                             lpszVersion, lpszReferer, lpszAcceptTypes,                             INTERNET_FLAG_KEEP_CONNECTION, dwContext) HttpSendRequest (hRequest, NULL, 0, NULL, 0); // at this point normal authentication logic can be used. If // credentials are supplied in InternetConnect, then Wininet will // resubmit credentials itself.  See HttpDump Internet Client SDK sample // for more information.  // Read all returned data with InternetReadFile ()  do {     InternetReadFile (hRequest, ..., &dwSize); } while ( dwRead != 0); // Now send real request that will be send with HttpSendRequestEx. By // this time all authentication is done // Note that we are using the same handle as HttpSendRequest<BR/> Again: HttpSendRequestEx (hRequest, ...); do {    InternetWriteFile()                  } while () ; // stop condition if ( !HttpEndRequest ()) {    if ( ERROR_INTERNET_FORCE_RETRY == (dwError= GetLastError() ) )    {         Goto again;    }    // handle other errors here }				
Performing all the authentication in HEAD request causes WinInet to createan appropriate authorization header that is sent with a large requestsubmitted by HttpSendRequestEx.
Internet Client SDK 4.0

177188 Using HttpSendRequestEx for large POST requests

Article ID: 194700 - Last Review: 02/21/2014 00:30:31 - Revision: 2.3

  • Microsoft Internet Client Software Development Kit 4.0
  • Microsoft Internet Client Software Development Kit 4.01
  • Microsoft Windows Internet Services (WinInet)
  • kbnosurvey kbarchive kbhowto KB194700