Problem - Kevin Tafuro

Solution
The Microsoft WinInet API was introduced with Internet Explorer 3.0. It provides a
set of functions that allow programs easy access to FTP, Gopher, HTTP, and HTTPS
servers. For HTTPS servers, the details of using SSLare hidden from the programmer,
allowing the programmer to concentrate on the data that needs to be
exchanged, rather than protocol details.
Discussion
The Microsoft WinInet API is a rich API that makes client-side interaction with FTP,
Gopher, HTTP, and HTTPS servers easy; as with most Windows APIs, however, a
sizable amount of code is still required. Because of the wealth of options available,
we won’t provide fully working code for a WinInet API wrapper here. Instead, we’ll
discuss the API and provide code samples for the parts of the API that are interesting
from a security standpoint. We encourage you to consult Microsoft’s documentation
on the API to learn about all that the API can do.
If you’re going to establish a connection to a web server using SSLwith WinInet, the
first thing you need to do is create an Internet session by calling InternetOpen( ).
This function initializes and returns an object handle that is needed to actually establish
a connection. It takes care of such details as presenting the user with the dial-in
UI if the user is not connected to the Internet and the system is so configured.
Although any number of calls may be made to InternetOpen( ) by a single application,
it generally needs to be called only once. The handle it returns can be reused
any number of times.
#include
#include
HINTERNET hInternetSession;
LPSTR lpszAgent = "Secure Programming Cookbook Recipe 9.4";
DWORD dwAccessType = INTERNET_OPEN_TYPE_PROXY;
LPSTR lpszProxyName = 0;
LPSTR lpszProxyBypass = 0;
DWORD dwFlags = 0;
hInternetSession = InternetOpen(lpszAgent, dwAccessType, lpszProxyName,
lpszProxyBypass, dwFlags);
If you set dwAccessType to INTERNET_OPEN_TYPE_PROXY, lpszProxyName to 0, and
lpszProxyBypass to 0, the system defaults for HTTP access are used. If the system is
configured to use a proxy, it will be used as required. The lpszAgent argument is
passed to servers as the client’s HTTP agent string. It may be set as any custom
string, or it may be set to the same string a specific browser might send to a web
server when making a request.
464 | Chapter 9: Networking
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.