how do you set WinInet to use a bearer token - oauth-2.0

Question

I am using OAuth2 with a server, and wininet as the http client. I cannot see how to set wininet to use a bearer token (just see how to set username and password for basic authentication). Is it possible to tell wininet to use a bearer token? (something like INTERNET_OPTION_USERNAME...)

Answer 1

This is same code to get access token from google. Note InternetOpenA uses NULL for username and password. If successful it reads a JSON file in to str which will contain access token, this access token is used with subsequent GET/POST requests.
std::string client_secret = "123";
std::string client_id = "1234";
std::string authorization_token = "token from browser";
std::string query, header;
{
stringstream ss;
ss << "code=" << authorization_token
<< "&client_id=" << client_id << ".apps.googleusercontent.com"
<< "&client_secret=" << client_secret
<< "&redirect_uri=urn:ietf:wg:oauth:2.0:oob&grant_type=authorization_code";
query = ss.str();
}
{
stringstream ss;
ss << "Content-Type: application/x-www-form-urlencoded\r\nContent-length: "
<< query.size() << "\r\nConnection: Close\r\n\r\n";
header = ss.str();
}
HINTERNET hopen = InternetOpenA("appname", INTERNET_OPEN_TYPE_PRECONFIG, NULL, NULL, 0);
HINTERNET hconnect = InternetConnectA(hopen,
"accounts.google.com", INTERNET_DEFAULT_HTTPS_PORT,
NULL, //username
NULL, //password
INTERNET_SERVICE_HTTP, 0, 1);
HINTERNET hrequest = HttpOpenRequestA(hconnect, "POST", "o/oauth2/token",
NULL, "http://localhost",
NULL, INTERNET_FLAG_SECURE | INTERNET_FLAG_DONT_CACHE, 0);
if(hrequest)
{
BOOL res = HttpSendRequestA(hrequest, header.c_str(), header.size(),
&query[0], query.size());
std::string data;
if(res)
{
DWORD received;
const int bufsize = 4096;
std::vector<BYTE> buf(bufsize);
while(InternetReadFile(hrequest, &buf[0], bufsize, &received) && received)
data.insert(data.end(), buf.begin(), buf.begin() + received);
std::string str(data.begin(), data.end());
//=> access token
}
InternetCloseHandle(hrequest);
}
InternetCloseHandle(hconnect);
InternetCloseHandle(hopen);

Answer 2

Pass "Authorization: Bearer " + the token to HttpAddRequestHeaders(). In my case I had to access an IdentityServer API from a win32 C++ MFC (WinInet) Client. Make sure to set InternetConnect() with the server domain instead of an IP address and that the token has correct scopes.
HINTERNET hSession, hConnect, hRequest;
hSession = InternetOpen( NULL, INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0 );
if( hSession )
{
CString strServerDomain = GetServerDomainName();
hConnect = InternetConnect( hSession, strServerDomain, INTERNET_DEFAULT_HTTPS_PORT,
NULL, NULL,INTERNET_SERVICE_HTTP, 0, 0 );
if( hConnect )
{
hRequest = HttpOpenRequest( hConnect, "GET", strParams, NULL, NULL, 0,
INTERNET_FLAG_DONT_CACHE | INTERNET_FLAG_SECURE, 0 ); // strParams = "projectName/controller/Action/"
if( hRequest )
{
CString strToken = "Your Token Goes Here"; // Token
CString strHeader = "";
strHeader.Format( "Authorization: Bearer %s", strToken );
BOOL bHeaderAdded = HttpAddRequestHeaders( hRequest, strHeader, strHeader.GetLength(), 0 );
ASSERT( bHeaderAdded );
BOOL hHttpRequest = HttpSendRequest( hRequest, NULL, 0, NULL, 0 );