WPAD Is On. Why Is WinHTTP's Proxy Address Empty?
Reading Windows proxy configuration and resolving a proxy for a destination are separate operations. Service identity adds another boundary.
Automatic proxy detection can be enabled while the manual proxy string is empty. WinHttpGetIEProxyConfigForCurrentUser() returns configuration fields, not a final endpoint for every destination.
| Field | Meaning |
|---|---|
| Manual proxy | An explicitly configured value |
| Automatic configuration URL | The PAC script's location |
| Auto-detect flag | Whether discovery is enabled |
The structure is output. Setting its auto-detect member before calling the function does not enable Windows discovery. Use the returned fields to construct a separate auto-proxy request with the documented flags.
Resolve, then apply
An API such as WinHttpGetProxyForUrl() evaluates the actual destination URL. Supply that URL, rather than the PAC download URL, and apply the resolution result to the relevant WinHTTP request.
A direct result is valid. Script download, script evaluation, and proxy connection errors occur at separate steps. Check failure codes and follow ownership rules for returned strings.
Whose configuration?
“CurrentUser” means the caller's context. A service without appropriate impersonation can read its service account's settings instead of the desktop user's.
Choose deliberately whether the service uses managed settings or follows an authorized user's configuration, including behavior when no interactive user exists. Token handling and resource cleanup must follow the supported identity APIs.
For diagnosis, keep the calling account, configuration fields, destination, resolution result, and first connection error together. That shows which stage produced the empty value or failed route.