PAC Authentication in a WinHTTP Client
Understand the default-credential flag used during WinHTTP PAC retrieval and the identity under which automatic configuration runs.
A WinHTTP application can need authentication just to retrieve its PAC file. That happens before the downloaded script has selected a proxy for the destination.
The fAutoLogonIfChallenged member of WINHTTP_AUTOPROXY_OPTIONS permits the current user’s default credentials to be used when the PAC server challenges the download. It is a Boolean policy choice, not a field in which to supply an arbitrary username and password.
A successful interactive browser download does not establish that this application can retrieve the file. WinHTTP does not supply the browser’s automatic login dialog. The application must use a delivery and authentication arrangement supported by its API.
Record whether the failure concerns the PAC hosting server or a later selected proxy. A hosting server’s 401 challenge and an intermediary’s 407 are different exchanges. For a later proxy 407, use request-scoped WinHTTP proxy credentials through the supported authentication flow.
For a background service, identify the account running that service. “Current user” can mean a service identity whose available credentials differ from those of the person who opened the browser.