title: Delphi soap https authentication failure pops up a dialog box
body: <p>We have a delphi XE application that uses SOAP (THTTPRIO etc) communications which (in delphi) works over WinInet.dll, by default.  We fixed the authentication code so that it works, using https authentication, and when the user name and password for https are correct, everything is fine.</p>
  
  <p>The problem is that when authentication details are incorrect, you get a message box from Windows, that is probably being popped up by WinInet.dll itself. I want to make that dialog box go away. I can't figure out how to change my Delphi SOAP so the password won't come up.</p>
  
  <p>The situation is <a href="https://stackoverflow.com/questions/2287219/how-to-prevent-dialog-basic-authentication-prompt-during-call-of-webservice">different than this question</a> in the following ways:</p>
  
  <ol>
  <li><p>I am doing all the things that he is doing, including calling InternetSetOption(...) to set the user name and password.</p></li>
  <li><p>I am not using a server with a self-signed certificate,  so the soIgnoreInvalidCerts flag is not applicable to my case.</p></li>
  <li><p>Somehow, I think I need to get some API calls into WinInet to tell it not to pop up the <code>InternetErrorDlg</code> that it has (some versions of windows say Windows Security Options) that pops up to ask the user.</p></li>
  <li><p>In my case the user name and password we have in our configuration file is being used, it is wrong (out of date) and so we want the WinInet code to simply return an error instead of popping up the dialog box.  </p></li>
  </ol>
  
  <p>Perhaps the other question the guy really did figure out how to do this, but the detail on that question is insufficient to see how he did it. The accepted answer does not work for me.</p>
  
  <p>Some dead ends I've followed:</p>
  
  <p>WinInet MSDN docs for <code>PLUGIN_AUTH_FLAGS_CAN_HANDLE_UI</code> - that doesn't appear to be applicable to a WinInet user, rather to a plugin.</p>
  
  <p>WinInet MSDN docs discuss InternetSetOption, and some newsgroups have lead me to the following on-before-post event handler code:</p>
  
  <pre><code>procedure TMyDevice.HTTPWebNodeOnBeforePost(
    const HTTPReqResp: SOAPHTTPTrans.THTTPReqResp; Data: Pointer);
  var
   SecurityFlagsLen:DWORD;
   SecurityFlags:DWORD;
  begin
    { authentication, NTLM+HTTPS, WinInet authentication set via WinInet SET INTERNET OPTION API.
      This approach recommended on newsgroups for https basic authentication.  }
  
      if fUserName&lt;&gt;'' then
     if not InternetSetOption(Data,
                 INTERNET_OPTION_USERNAME,
                 PChar(fUserName),
                 Length(fUserName)) then
       raise EWebServiceAuthException.Create(SysErrorMessage(Windows.GetLastError));
  
     if fPassword&lt;&gt;'' then
    if not InternetSetOption(Data,
                 INTERNET_OPTION_PASSWORD,
                 PChar(fPassword),
                 Length (fPassword)) then
       raise EWebServiceAuthException.Create(SysErrorMessage(Windows.GetLastError));
  
        { possible type of hackage: WinInet Security option flags to stop password box? }
       SecurityFlagsLen := SizeOf(SecurityFlags);
        InternetQueryOption({Request}data, INTERNET_OPTION_SECURITY_FLAGS,
        Pointer(@SecurityFlags), SecurityFlagsLen);
        SecurityFlags := SecurityFlags or SECURITY_FLAG_something;
        InternetSetOption({Request}data, INTERNET_OPTION_SECURITY_FLAGS,
        Pointer(@SecurityFlags), SecurityFlagsLen);
  end;
  </code></pre>
  
  <p>This code makes the password work, but when the user's entered password is wrong, how do I get the SOAP call to fail, or raise an exception, instead of popping up a message box?</p>