Problem - Kevin Tafuro

server name, starting with the forward slash and ending before the query string
(which starts with a question mark). Specifying lpszAcceptTypes as 0 tells the server
that we can accept any kind of text document; it is equivalent to a MIME type of
“text/*”.
The most interesting argument passed to HttpOpenRequest( ) is dwFlags. A large number
of flags are defined, but only five deal specifically with HTTP over SSL:
INTERNET_FLAG_IGNORE_CERT_CN_INVALID
Normally, as part of verification of the server’s certificate, WinInet will verify
that the hostname is contained in the certificate’s commonName field or
subjectAltName extension. If this flag is specified, the hostname check will not be
performed. (See Recipes 10.4 and 10.8 for discussions of the importance of performing
hostname checks on certificates.)
INTERNET_FLAG_IGNORE_CERT_DATE_INVALID
An important part of verifying the validity of an X.509 certificate involves checking
the dates for which a certificate is valid. If the current date is outside the certificate’s
valid date range, the certificate should be considered invalid. If this flag
is specified, the certificate’s validity dates are not checked. This option should
never be used in a released version of a product.
INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTP
If this flag is specified and the server attempts to redirect the client to a non-SSL
URL, the redirection will be ignored. You should always include this flag so you
can be sure you are not transferring in the clear data that you expect to be protected.
INTERNET_FLAG_IGNORE_REDIRECT_TO_HTTPS
If this flag is specified and the server attempts to redirect the client to an SSLprotected
URL, the redirection will be ignored. If you’re expecting to be communicating
only with servers under your own control, it’s safe to omit this flag; if
not, you might want to consider including it so you’re not transferred somewhere
other than expected.
INTERNET_FLAG_SECURE
This is the all-important flag. When this flag is included, the use of SSLon the
connection is enabled. Without it, SSLis not used, and all data is transferred in
the clear. Obviously, you want to include this flag.
Once the request object has been constructed, the request needs to be sent to the
server. This is done by calling HttpSendRequest( ) with the request object. Additional
headers can be included with the request submission, as well as any optional data to
be sent after the headers. You will want to send optional data when performing a
POST operation. Additional headers and optional data are both specified as strings
and the lengths of the strings.
BOOL bResult;
LPSTR lpszHeaders = 0;
466 | Chapter 9: Networking
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.