Help / WLanguage / WLanguage functions / Communication / HTTP functions
  • Security error in a secure transaction
  • Retrieving the result
  • Accessing a password-protected URL
  • Using a proxy
  • Authentication headers
  • Limitations
  • Required application feature
WindowsLinuxUniversal Windows 10 AppJavaReports and QueriesUser code (UMC)
WindowsLinuxPHPWEBDEV - Browser code
AndroidAndroid Widget iPhone/iPadIOS WidgetApple WatchMac CatalystUniversal Windows 10 App
Stored procedures
From version 28, this function is kept for compatibility only (especially for PHP programming). It is recommended to use a variable of type httpRequest with the HTTPSend function.
Starts an HTTP request on a server. The result of the query (buffer) can be:
WINDEV Tip: Use HTTPSend to execute an HTTP request. This function uses an httpRequest variable in order to precisely describe the HTTP request.
  • Two types of requests are supported: POST and GET. The GET requests are automatic. If the "Message to send" is not specified, it is a GET request (see the syntax). To manage forms, it is recommend to use form-specific functions (HTTPCreateForm, HTTPSendForm, etc.).
// Retrieve the HTML code of "" Web page
ResStart = HTTPRequest("")
// Retrieve an HTML page that uses a protected URL
ResStart = HTTPRequest("", ...
"", "", "", "", "Julia", "Password")
<Result> = HTTPRequest(<URL to contact> [, <User agent> [, <Additional HTTP header> [, <Message to send> [, <Message type> [, <Username> [, <Password>]]]]]])
<Result>: Boolean
  • True if the request was started,
  • False if an error occurs. To get more details on the error, use ErrorInfo with the errMessage constant.
    The result of the request can be saved in a backup file by HTTPDestination or it can be retrieved by HTTPGetResult.
    Universal Windows 10 AppJava The errors regarding the security of transactions are not returned by ErrorInfo: the connection is refused.
<URL to contact>: Character string
Address of server to contact (URL address). This parameter can contain:
  • the port number for connecting to the server. The default value is 80 (corresponds to a server of Web pages). To specify a port number, use the following format: "<Server URL>:<Port #>". For example:
  • additional parameters. These parameters can be used to perform a search or to fill a form. For example, to find "windev" on "", the URL to contact will be: "".
  • To specify both the port number and additional parameters, use the following format: "<Server URL>:<Port #>/<Additional parameters>".
  • To perform a secure transaction, the URL must start with "https://". In this case, the management mode of requests is always performed by Internet Explorer (for more details, see HTTPConfigure).
<User agent>: Optional character string
Identifies the client. The application name is returned by default.
The content of the response may depend on the user agent (for example, a request performed from a mobile device and a request performed from a PC browser require different pages). In this case, for more details, see the documentation of user agent.
<Additional HTTP header>: Optional character string
  • Additional HTTP header that will be added to the HTTP message,
  • Empty string ("") if no HTTP header must be added.
<Message to send>: Optional character string
HTTP message that will be sent to the server. This parameter can be specified only for a request for sending messages (POST request). The message to send must comply with the HTTP protocol used. If this parameter is specified and if it is not empty, it is a POST request; otherwise, it is a GET request (everything else is automatic).
<Message type>: Optional character string
Type of the HTTP message content to be sent to the server. This parameter can be specified only for a request for sending messages (POST request). This parameter corresponds to "Content-Type".
By default, the message type corresponds to: "application/x-www-form-urlencoded".
However, you have the ability to use any value, for example: "text/xml", "application/javascript", "application/json", "application/xml", "image/jpeg", ... To send rough data that will be read at once by the WEBDEV Application Server, use the following types:
  • "application/octet-stream".
  • "text/xml".
<Username>: Optional character string
Name used to access a page with a protected URL (empty string by default). This name is used to identify the user.
Remark: When the <Username> and <Password> parameters are specified, the corresponding "Authorization:Basic" request header is automatically generated.
<Password>: Optional character string
Password associated with the username (empty string by default). Used to access a page with a protected URL. Caution: The password is not encrypted when it is sent over the Internet.
Remark: When the <Username> and <Password> parameters are specified, the corresponding "Authorization:Basic" request header is automatically generated.

Security error in a secure transaction

During a secure transaction, the request may fail due to security errors:
  • invalid certificate or certificate coming from an unknown company.
  • the site name specified in the certificate does not correspond to a server.
  • invalid or expired certificate date.
  • redirection to a non-secure server.
  • ...
These errors are returned by ErrorInfo.
If one of these errors occurs, you can re-run the request while ignoring the errors. To do so, use the HTTP.IgnoreError variable.
The HTTP.IgnoreError variable can also be used to manage special cases during the secure transactions (ignoring the list of revoked certificates for example).
Error returned by ErrorInfo
(with the errCode constant)
Value of HTTP.IgnoreError
(these values can be combined)
Invalid certificate or certificate coming from an unknown company
httpIgnoreInvalidCertificateThe certificate is ignored.
The site name specified in the certificate does not correspond to a server
httpIgnoreInvalidCertificateNameThe site name specified in the certificate is ignored.
Invalid or expired certificate date
httpIgnoreExpiredCertificateThe certificate date is ignored
Redirection to a non-secure server
httpIgnoreRedirectToHTTPThe redirection to a non-secure server is allowed.
Redirection to a secure server
httpIgnoreRedirectToHTTPSThe redirection to a secure server is allowed.
httpIgnoreRedirectionThe redirection to a page is ignored.
httpIgnoreRevocationThe certificate found in the list of revoked certificates is not checked.
For example:
// Start a request on a secure server
ResStart = HTTPRequest("")
// If an error occurs
IF ResStart = False THEN
// According to the type of error
SWITCH ErrorInfo(errCode)
// Invalid certificate 
// or coming from an unknown company
CASE httpErrorInvalidCertificate: 
// Ignore the certificate?
IF YesNo("Security alert detected!", ...
"Invalid certificate.", ...
"Ignore this certificate?") = Yes THEN
HTTP.IgnoreError = httpIgnoreInvalidCertificate
// Start the request again 
// while ignoring this error
// Invalid or expired certificate date
CASE httpErrorExpiredCertificate: 
// Ignore the certificate date?
IF YesNo("Security alert detected!", ...
"Certificate date invalid or expired.", ...
"Ignore this date?") = Yes THEN
HTTP.IgnoreError = httpIgnoreExpiredCertificate
// Start the request again 
// while ignoring this error
  • When the HTTP queries are run in several threads, the HTTP.IgnoreError variable has a specific value for each thread.
  • Universal Windows 10 App The errors regarding the security of transactions are ignored. The HTTP.IgnoreError variable is not available.
  • Java
    Before version 200057, the errors regarding the security of transactions were ignored. The HTTP.IgnoreError variable was not available.
    From version 200057, the following errors are supported: httpIgnoreExpiredCertificate, httpIgnoreInvalidCertificate, httpIgnoreInvalidCertificateName, httpIgnoreRevocation. The other errors are ignored. For backward compatibility, all the errors are ignored on the existing projects. These errors are supported on the new projects only.

Retrieving the result

HTTPGetResult is used to retrieve the result of the last HTTP request run.
When a destination file is specified by HTTPDestination:
  • when HTTPGetResult is used with the httpResult constant, it always returns an empty string ("").
  • HTTPGetResult associated with the httpHeader constant always returns the header of the HTTP response. This header is not saved in the destination file: only the data is saved.
When the request is over, the destination is canceled and HTTPRequest operates as usual.
WINDEVUniversal Windows 10 AppUser code (UMC)

Accessing a password-protected URL

To access a password-protected URL, you can:
  • use the <Username> and <Password> parameters found in the syntax of HTTPRequest.
  • specify the username and password in the <URL to contact> parameter. For example:
    <Res> = HTTPRequest("http://<user>:<password>@<URL to contact>")
WINDEVUser code (UMC)

Using a proxy

To access the URL specified in HTTPRequest via a proxy, use Proxy.
WINDEVUniversal Windows 10 AppUser code (UMC)

Authentication headers

The authentication headers are automatically generated in the following cases:
  • If HTTPRequest uses the syntax with username and password.
  • If the server URL is password protected.
  • If Proxy is used.
Universal Windows 10 App


  • The proxy used is the one of Internet Explorer.
  • The certificates cannot be ignored.
Universal Windows 10 App

Required application feature

When this function is used, an application feature is declared in the application generation wizard.
Required feature: Internet and public networks (outgoing).
This feature allows the applications to use the accesses to Internet and to the public networks.
Component: wd300com.dll
Minimum version required
  • Version 9
This page is also available for…
exemplo httprequest
S_url is string=""
IF HTTPRequest(S_url) THEN
let json_dados=JSONToVariant(EDT_retorno)
FOR EACH json_linha OF json_dados..Member
FOR EACH json_linha_Detalhe OF json_linha
IF json_linha_Detalhe..Name="high" THEN
11 May 2021

Last update: 09/06/2023

Send a report | Local help