title: WinHTTP VBA subsequent request cannot use the previous login credentials?
body: <p>I'm using WinHTTP in Access 2007 VBA to fetch some list of items requiring a <strong>cookie login credential account</strong>.</p>
  
  <p>First I login through <a href="https://www.example.com/login.php" rel="nofollow">https://www.example.com/login.php</a> with this:</p>
  
  <pre><code>  Dim strCookie As String, strResponse As String, _
      strUrl As String
  '
    Dim xobj As Object
  '
    Set xobj = New WinHttp.WinHttpRequest
  '
    strUrl = "https://www.example.com/login.php"
    xobj.Open "POST", strUrl, False
    xobj.SetRequestHeader "User-Agent", "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
    xobj.SetRequestHeader "Content-Type", "application/x-www-form-urlencoded"
    xobj.Send "username=johndoe2&amp;password=mypassword"
  '
    strCookie = xobj.GetResponseHeader("Set-Cookie")
    strResponse = xobj.ResponseText
  </code></pre>
  
  <p>The content of <em>strResponse</em> indicates that my login is OK, as <strong>johndoe2</strong> is welcomed in this string. <em>strCookie</em> saves the Set-Cookie returned by the HTTP server after the successful login.</p>
  
  <p>Next I need to get a confidential page only accessible for a logged user: <a href="https://www.example.com/secret-contents.php" rel="nofollow">https://www.example.com/secret-contents.php</a>. I do this, with previous Set-Cookie header <em>strCookie</em>, resent to the server:</p>
  
  <pre><code>'
  ' now try to get confidential contents:
  '
    strUrl = "https://www.example.com/secret-contents.php"
    xobj.Open "GET", strUrl, False
    xobj.SetRequestHeader "Cookie", strCookie
    xobj.Send
  '
    strCookie = xobj.GetResponseHeader("Set-Cookie")
    strResponse = xobj.ResponseText
  </code></pre>
  
  <p>Unfortunately, it's failed, as the new <em>strResponse</em> indicates that the fetched content is not the required one, but rather again the login page. And also <em>strCookie</em> has changed.</p>
  
  <p>This has been tested and produces no effect, as it's only for Windows/OS linked authentication, such as the famous basic, NTLM, digest and Kerberos authentications, not for that based on cookie:</p>
  
  <pre><code>xobj.SetCredentials "johndoe2", "mypassword", 0
  </code></pre>
  
  <p>What else to send as headers to the remote server other than Set-Cookie, in order to use the previously certified credential ?</p>
  
  <p>The server uses typo3 CMS framework.</p>