When WinHTTP Alternates Between 407 and 401
Preserve the selected proxy authentication state and reapply it before retries while handling a separate destination challenge.
A WinHTTP request authenticates to the proxy, receives a website's 401, then gets another 407 on its next send. The proxy and website have separate authentication state, and the resend path needs to retain both.
Microsoft's native WinHTTP authentication sample keeps the chosen proxy scheme in a variable and reapplies the proxy account before each WinHttpSendRequest after that scheme has been selected.
- Send the request and inspect the response.
- For a 407, query the offered schemes and remember the chosen proxy scheme.
- Before resending, call WinHttpSetCredentials for WINHTTP_AUTH_TARGET_PROXY with that scheme and account.
- For a destination 401, obtain its scheme and set its server credentials while retaining the remembered proxy state for the next send.
The sample specifically notes reauthentication after a server challenge or redirect as a reason for reapplying the proxy credentials. Placing the call only in the first 407 branch can leave another retry path without the expected setup.
Check every API result and keep repeated failures bounded. Microsoft's compact sample tracks the previous status, while a production retry policy should also recognize a repeated alternating sequence.
If the user supplies a replacement account after a failure, update the values used by that resend path. WinHttpSetCredentials is request-scoped; it is not a process-wide password store whose contents are replaced for all future requests.