And what would you like to have happen? If you're accessing a secured resource you have to provide authentication. End of story <s>...

You're making all the wrong assumptions about security based on what you are saying here. I suspect part of the reason why this works in some situations without explicit authentication is that IE can automatically (based on IE browser settings) use passthrough authentication when connecting to intranet sites (anything that can be validated against a local server/domain server on a local network) whereas any external access requires full authentication credentials.

XmlHttp is the most low end tool for HTTP communication anyway with the least amount of options, but all the Microsoft HTTP clients eventually go through the WinInet stack which basically works the same in terms of handling automatic authentication. If you want to be sure specific credentials are used always pass them explicitly.

+++ Rick ---



>Hi,
>
>We have an application that calls to exernal web-based resources via Microsoft XML HTTP services.
>
>oMyXMLHttp = CREATEOBJECT("Microsoft.xmlhttp")
>...
>
>The process works fine on dev. machines as well most user configurations including in cases where http services require authentication. In such cases the user is routinely requested for "user/password" authentication everytime the application calls for internet resources in the same way one is when calling for internet resources within their IE browser.
>
>Alas we are running into a series of cases where "windows authentication" will fail miserably without a hint when using our app whilst IE will work fine with the same user/password combinations. These are workstations located on "big shops" intranets with secured workstations.
>
>We cannot trust our applications to work in such cases! Any hint on the reason for such behaviour, any solution or documentation on what looks like a real nasty issue "Getting xml http services to run".
>
>Francis