chilkat.Http

When set to true, causes the currently running method to abort. Methods that always finish quickly (i.e.have no length file operations or network communications) are not affected. If no method is running, then this property is automatically reset to false when the next method is called. When the abort occurs, this property is reset to false. Both synchronous and asynchronous method calls can be aborted. (A synchronous method call could be aborted by setting this property from a separate thread.)

This property sets the Accept header for all HTTP requests, except those sent by the HttpReq and HttpSReq methods that use headers from an HttpRequest object.

By default, it is set to */*.

Setting this property is the same as calling SetRequestHeader with Accept as the header field name.

The Accept HTTP header is sent by the client (your application) to tell the server which content types (MIME types) it can handle in the response.

For example, the following means only a JSON response is accepted:

Accept: application/json

If true then the Accept-Encoding: gzip is automatically added for all HTTP requests, except those made using the HttpReq and HttpSReq methods that use headers from an HttpRequest object.

The default value is true.

The Accept-Encoding HTTP header is sent by the client to tell the server which compression algorithms it supports for the response body.

Example:

Accept-Encoding: gzip, deflate

This means the client can handle responses compressed with gzip or deflate.

If this property is set to false, then the Accept-Encoding header is added, but the value is empty, like this:

Accept-Encoding: 

It means the client explicitly does not accept any content codings (no compression, no transformations).

• An absent Accept-Encoding header means the client will accept any encoding (server chooses, often gzip).
• An empty Accept-Encoding header means only the “identity” encoding (i.e., uncompressed) is acceptable.

The SetRequestHeader method can be called with Accept-Encoding as the header field name to explicitly set the Accept-Encoding header. Note: Chilkat does not accept Brotli responses. Do not include br in the list of encodings for this header.

The RemoveRequestHeader can be called to explicit omit the Accept-Encoding header field from HTTP requests.

When set to false, MIME header folding is not applied to request headers automatically. By default, this setting is true. This property exists for rare instances when a server cannot properly handle folded MIME headers.

MIME header folding allows long header lines to be split across multiple lines for readability.

A folded line begins with whitespace (space or tab), which signals continuation.

Unfolded (single line):

Subject: This is a very long subject line that needs to be wrapped across lines

Folded (wrapped for transport):

Subject: This is a very long subject line
 that needs to be wrapped across lines

When received, the folded version is unfolded back into a single line by removing the CRLF + leading whitespace.

This property can be set to a JSON string containing the required information to add an HTTP Signature in the following format:

Authorization: Signature
  keyId="my-key-1",
  algorithm="hmac-sha256",
  headers="(request-target) host date",
  signature="Base64OfSignature"

See the linked example below for details.

Applications can set this property to the OAuth2 access_token value to be sent in the Authorization: Bearer {access_token} header for all requests. For OAuth1.0a tokens, use the OAuthToken property instead.

Starting from Chilkat v10.1.2, this method can also accept a JSON string containing details needed for automatic OAuth2 access token retrieval via the Client Credentials flow. The JSON must include the client secret, client ID, token endpoint, and scope(s). See the example below for guidance. This feature is compatible with any OAuth2 provider that supports the client credentials flow.

When set to true (the default), the Host header is automatically added to all requests. The domain for the Host header is taken from the URL passed in a method's arguments.

The Host HTTP header specifies the hostname (and optional port) of the server the client is trying to reach.

Example:

Host: www.example.com

It’s required in HTTP/1.1 so a server can distinguish between multiple sites (virtual hosts) on the same IP address.

The AWS Access Key to be used with the Amazon S3 methods listed below.

Specify the regional endpoint (domain) for Amazon S3 method calls. The default is s3.amazonaws.com, but you can use any valid Amazon S3 endpoint, such as s3-eu-west-1.amazonaws.com, or endpoints from other S3-API compatible services.

The AWS S3 region (e.g., us-east-1, us-west-2, eu-west-1, eu-central-1) defaults to us-east-1. It is relevant only when the AwsSignatureVersion property is set to 4 and ignored when set to 2.

The AWS Secret Key to be used with the Amazon S3 methods listed below.

This is the AWS session token for temporary security credentials.

When you call AssumeRole with AWS STS, you get temporary security credentials consisting of:

• Access key ID
• Secret access key
• Session token

The session token is an extra credential that must be included with the access key and secret key when signing requests. It proves the credentials came from STS and are valid for the limited session duration.

In short: The AWS session token is a required component of temporary STS credentials, used alongside the key pair to authenticate API calls.

This property can be used to specify sub-resources to be included in the Amazon S3 methods listed below. For example, set the property to acl&versionId=value to request the acl for a specific version of an object.

In Amazon S3, sub-resources are special query parameters you can append to an S3 object or bucket URL to access or manage specific properties or features beyond the main resource itself.

Examples:

• Bucket sub-resources: ?logging, ?website, ?lifecycle, ?policy
• Object sub-resources: ?acl, ?torrent, ?restore, ?tagging

So:

• Resource = the bucket or object itself (e.g., mybucket/photo.jpg)
• Sub-resource = a specific aspect or configuration of it, accessed with a query string (e.g., mybucket?logging or photo.jpg?acl).

In short: S3 sub-resources let you operate on metadata/configuration of a bucket or object, not the content itself.

If set to a non-zero value, this limits the download bandwidth to the specified maximum number of bytes per second. The default value is 0.

If set to a non-zero value, this property limits the upload bandwidth to the specified maximum number of bytes per second. The default is 0.

To enable HTTP basic authentication, set this property to true. The default value is false.

Then basic authentication is enabled, Chilkat uses the Login and Password properties to include the Authorization: Basic {base64} header in all requests.

HTTP Basic Authentication is a simple authentication scheme where the client sends a username and password encoded in Base64 in the Authorization header.

Example:

Authorization: Basic dXNlcjpwYXNzd29yZA==

Here dXNlcjpwYXNzd29yZA== is the Base64 of user:password.

A computer can have multiple network interfaces (e.g., Ethernet, Wi-Fi, VPN, virtual adapters). Each interface can have one or more IP addresses (IPv4 and/or IPv6).

If multiple IPs exist (say, 192.168.1.10 on Wi-Fi and 10.0.0.5 on Ethernet), the application can bind explicitly to either one, determining which interface and address the socket will use for communication.

This property can be set to explicitly bind the communications socket to an IP address.

The default value is the empty string, which means the application does not bind to a specific local IP before connecting and the OS network stack automatically picks the default source IP.

This property will be set to the status of the last HTTP connection made (or failed to be made) by any HTTP method.

Possible values are:

0 = success

Normal (non-TLS) sockets:
1 = empty hostname
2 = DNS lookup failed
3 = DNS timeout
4 = Aborted by application.
5 = Internal failure.
6 = Connect Timed Out
7 = Connect Rejected (or failed for some other reason)
50 = HTTP proxy authentication failure.
98 = Async operation in progress.
99 = Product is not unlocked.

SSL/TLS:
100 = TLS internal error.
101 = Failed to send client hello.
102 = Unexpected handshake message.
103 = Failed to read server hello.
104 = No server certificate.
105 = Unexpected TLS protocol version.
106 = Server certificate verify failed (the server certificate is expired or the cert's signature verification failed).
107 = Unacceptable TLS protocol version.
108 = App-defined server certificate requirements failure.
109 = Failed to read handshake messages.
110 = Failed to send client certificate handshake message.
111 = Failed to send client key exchange handshake message.
112 = Client certificate's private key not accessible.
113 = Failed to send client cert verify handshake message.
114 = Failed to send change cipher spec handshake message.
115 = Failed to send finished handshake message.
116 = Server's Finished message is invalid.
125 = Peer tried to connect using older SSL 2.0 protocol version.
126 = TLS Pin Set Mismatch.
127 = TLS 1.3 handshake error.

Determines the maximum time, in seconds, to wait for an HTTP server to accept a TCP connection before timing out. The default value is 30 seconds.

Note: A TLS connection always starts with a normal TCP connection (e.g., client connects to server on port 443). Once TCP is established, the client and server perform a TLS handshake: they exchange cryptographic messages to authenticate, agree on encryption keys, and set up a secure channel.

The ReadTimeout property applies to TLS handshake communications. When establishing a TLS connection, the ConnectTimeout governs the initial TCP connection, followed by the ReadTimeout.

Designates a directory path for automatic cookie storage (such as "c:/myCookieDir" or "/Users/example/myCookieDir") when the SaveCookies property is set to true. Cookies are saved in XML files, with one file per domain. Alternatively, set the value to memory to cache cookies in memory.

The default value is the empty string, which means cookies are not saved regardless of the SaveCookies setting.

If set to a file path, this property logs the LastErrorText of each Chilkat method or property call to the specified file. This logging helps identify the context and history of Chilkat calls leading up to any crash or hang, aiding in debugging.

Enabling the VerboseLogging property provides more detailed information. This property is mainly used for debugging rare instances where a Chilkat method call causes a hang or crash, which should generally not happen.

Possible causes of hangs include:

• A timeout property set to 0, indicating an infinite timeout.
• A hang occurring within an event callback in the application code.
• An internal bug in the Chilkat code causing the hang.

Sets the default freshness period (in minutes) for cached documents when the FreshnessAlgorithm property is set to 0. The default value is 10080 (1 week).

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Setting this property to true causes the HTTP component to use digest authentication. The default value is false.

HTTP Digest Authentication is a challenge–response mechanism where the server sends a nonce (a unique random value) to the client. The client must hash the username, password, nonce, and request details (method, URI) into a digest using MD5 (or similar). The server performs the same calculation to verify.

Unlike Basic Auth, the password is never sent in clear text—only the hash is transmitted—making it more secure against eavesdropping.

This property that automatic resolution of credentials from the operating system’s secure storage.

When set to true, the supported properties and methods (listed below) can accept a secret specification string (beginning with !!) in place of a literal value. Chilkat detects this format and retrieves the corresponding secret from:

• Windows Credential Manager (Windows)
• Apple Keychain (macOS)

Secrets are identified using a structured string format: !![appName|]service[|domain]|username

Applies to AwsAccessKey , AwsEndpoint , AwsRegion , AwsSessionToken , AwsSecretKey , ProxyPassword , SocksPassword , Password .

This feature allows applications to avoid embedding sensitive data directly in code by securely resolving credentials at runtime.

The default value is false

Set to true to enable fetching pages from cache whenever possible. The default value is false. Only HTTP GET requests are cached. HTTP responses containing Set-Cookie headers are never cached. A page is retrieved from the disk cache if it exists and is deemed fresh by the FreshnessAlgorithm property. If the cached page is stale, the HTTP component will send a revalidate request and update the cache based on the response.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

If the WasRedirected property indicates an HTTP GET was redirected, and the FollowRedirects property is set to true, this property will hold the final redirect URL. This property will also contain the redirect URL for 301/302 responses, even if FollowRedirects is not true.

When set to true, 301, 302, 303, 307, and 308 redirects are automatically followed. The default setting is true.

To determine if a redirect occurred, check the WasRedirected property. The final URL after redirection is available in the FinalRedirectUrl property.

To determine the freshness of a cached HTTP GET response, the freshness algorithm is employed. By default, it uses the LM-factor algorithm, which is activated when the FreshnessAlgorithm is set to 1. The LMFactor property, ranging from 1 to 100, specifies the percentage of the time since the last modification date of the HTML page that the page remains fresh. For instance, if the LMFactor is 50 and the page was last modified 10 days ago, it will expire after 5 days (50% of 10 days). This applies only to HTTP responses without explicit expiration information. If the FreshnessAlgorithm is set to 0, a constant expiry period, defined by the DefaultFreshPeriod property, is applied.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

The interval in milliseconds between each AbortCheck event callback, which enables an application to abort certain method calls before they complete. By default, HeartbeatMs is set to 0, meaning no AbortCheck event callbacks will trigger.

If an HTTP response includes the Cache-Control: must-revalidate header, it indicates that the server requires the client to revalidate the page with the server rather than serving it directly from the cache. However, if this property is set to true, the page will be served directly from the cache without revalidation until it expires. The defautl value of this property is false.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Some HTTP responses include headers indicating the page should not be cached. Chilkat HTTP will follow these instructions unless this property is set to true. The default value of this property is false.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

If set to true, the response body, if it is text, is stored in the LastResponseBody property for methods not returning an HttpResponse object. By default, this property is false.

Note: Many methods provide an HttpResponse object as their final output argument.

The Content-Type header value from the most recent HTTP response received.

Provides HTML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

Provides plain text information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

Provides XML-formatted information about the last called method or property. If a method call fails or behaves unexpectedly, check this property for details. Note that information is available regardless of the method call's success.

true if the last GET was fetched from cache.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Contains the text of the last HTTP header sent by any method.

An HTTP request begins with a start line (called the *status line*), which contains the protocol version, status code, and reason phrase (e.g., HTTP/1.1 200 OK).

After that comes the header section, made up of key–value pairs (like Content-Type: text/html).

This property contains both the start line and the header section. For example:

POST /echo_request_body.asp HTTP/1.1
Host: chilkatsoft.com
Accept: */*
Accept-Encoding: gzip
Content-Type: application/json
Content-Length: 26

Indicates the success or failure of the most recent method call: true means success, false means failure. This property remains unchanged by property setters or getters. This method is present to address challenges in checking for null or Nothing returns in certain programming languages. Note: This property does not apply to methods that return integer values or to boolean-returning methods where the boolean does not indicate success or failure.

The Last-Modified header value from the most recent HTTP response received.

The response body from the last HTTP request is saved in this property only if the KeepResponseBody property is set to TRUE. This applies to methods that don't return an HttpResponse object.

Returns the most recent full response header for methods that do not use an HttpResponse object. For example:

Content-Type: application/json
Last-Modified: Sun, 20 Aug 2023 11:36:27 GMT
Accept-Ranges: bytes
ETag: "34c27f8e5ad3d91:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Sat, 30 Aug 2025 14:35:55 GMT
Content-Length: 22

Contains the most recent response status code for methods that don't utilize an HttpResponse object.

Contains the latest response status text for methods that don't use an HttpResponse object. The response status text appears after the status code in the first line of an HTTP response. For example, in the HTTP response below, the status text is OK:

HTTP/1.1 200 OK
Content-Type: application/json
Last-Modified: Sun, 20 Aug 2023 11:36:27 GMT
Accept-Ranges: bytes
ETag: "34c27f8e5ad3d91:0"
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Sat, 30 Aug 2025 14:35:55 GMT
Content-Length: 22

{ "hello": "world" }

The LMFactor is an integer between 1 and 100 that specifies the percentage of time from an HTTP page's last-modified date to be used as the freshness period. The default is 25. For instance, if a page's last-modified date is 4 weeks ago and LMFactor is set to 25, the page will remain fresh in the cache for 1 week (25% of 4 weeks).

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

This is the login string to be used with HTTP basic, digest, or NTLM authentication.

The optional domain name to be used with NTLM authentication.

In NTLM HTTP authentication, the login domain is the Windows domain that contains the user account.

The client sends it in the NTLM messages (e.g., DOMAIN\Username) so the server knows which domain controller to contact to verify the credentials. If no domain is given, the server may fall back to checking local machine accounts.

This class automatically manages simultaneous open HTTP connections. If the maximum number of connections is reached, the least recently active connection is automatically closed. The default value is 10.

An HTTP connection can remain open if the client and server use persistent connections (e.g., Connection: keep-alive in HTTP/1.1).

This allows multiple requests and responses to be sent over the same TLS connection instead of opening a new one each time.

Reasons:

• Reduces latency (no repeated TLS handshakes).
• Improves efficiency for sending many requests.

Also see: CloseAllConnections

Sets a time limit for how long a document can remain fresh in the cache, measured in minutes, with a default value of 525,600 minutes (equivalent to 1 year).

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Specify the maximum HTTP response size the program will accept. The default value of 0 means there is no size limit. This safeguard helps prevent receiving excessively large responses that could hang or crash the application.

Limit the length of URLs (including URL parameters) in HTTP requests by setting this property. The default value is 2000 characters.

Sets the minimum time a document stays fresh in the cache, with a default of 30 minutes.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Set this property equal to true for Negotiate authentication.

Note: The NegotiateAuth property is only available for the Microsoft Windows operating system.

Setting this property to true causes the HTTP component to use NTLM authentication (also known as IWA -- or Integrated Windows Authentication) when authentication with an HTTP server. The default value is false.

This setting determines the directory levels used under each cache root. The default value is 0, meaning cached HTML pages are stored directly in the cache root directory.

• Level 0: Cached pages are stored in the cache root directory.
• Level 1: Cached pages go into one of 255 subdirectories (0 to 255) under the cache root.
• Level 2: Two levels of subdirectories (0-255/0-255) are created under each cache root.

The HTTP class automatically creates these subdirectories as needed. Multiple directory levels help prevent issues caused by having too many files in a single directory.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Specifies the number of established cache roots used by the HTTP cache to distribute the disk cache across multiple directories. Each cache root is an absolute directory path, set using the AddCacheRoot method.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

If true then causes an OAuth Authorization header to be added to any request sent by the HTTP object. For example:

Authorization: OAuth realm="http://sp.example.com/",
                oauth_consumer_key="0685bd9184jfhq22",
                oauth_token="ad180jjd733klru7",
                oauth_signature_method="HMAC-SHA1",
                oauth_signature="wOJIO9A2W5mFwDgiDvZbTSMK%2FPY%3D",
                oauth_timestamp="137131200",
                oauth_nonce="4572616e48616d6d65724c61686176",
                oauth_version="1.0"

When set to true, the oauth_body_hash, which contains the SHA-256 hash of the HTTP request body, is automatically included in the OAuth1.0a Authorization header.

For example:

Authorization: OAuth oauth_consumer_key="***", 
  oauth_nonce="A2E91C3B53E0BD7FBF71F441336679E358DDCEEE",
  oauth_body_hash="a5kPTsDwUwmBjC0voNlAAvM6YoaRS5X7sTO49jl3/h8=",
  oauth_timestamp="1756324932",
  oauth_signature_method="RSA-SHA256",
  oauth_version="1.0",
  oauth_signature="****"

This property is only used when the OAuth1 property equals true.

The OAuth 1.0a callback URL. Defaults to oob.

This property is only used when the OAuth1 property equals true.

The OAuth1.0a consumer key to be used in the oauth_consumer_key parameter of the Authorization header.

This property is only used when the OAuth1 property equals true.

The consumer secret to be used in computing the contents of the OAuth1.0a Authorization header.

This property is only used when the OAuth1 property equals true.

The OAuth1.0a realm to be used in the Authorization header.

The OAuth 1.0a realm parameter is an optional, descriptive string in the Authorization header that indicates the protected resources’ scope. It is not required, not included in the signature, and rarely used in real-world APIs. Most modern OAuth 1.0a integrations ignore it completely.

This property is only used when the OAuth1 property equals true.

Specify the oauth_signature_method parameter in the OAuth 1.0a Authorization header. The default method is HMAC-SHA1, but it can be set to HMAC-SHA256, RSA-SHA1, or RSA-SHA256. For RSA methods, provide an RSA private key using the SetOAuthRsaKey method.

This property is only used when the OAuth1 property equals true.

Note that RSA-SHA256 is supported from Chilkat v9.5.0.56 onwards.

The value to be used for the oauth_token parameter in the OAuth1.0a Authorization header.

This property is only used when the OAuth1 property equals true.

The OAuth1.0a token secret to be used in computing the Authorization header.

This property is only used when the OAuth1 property equals true.

The value to be used for the verifier to be used in the oauth_verifier parameter of the OAuth1.0a Authorization header.

This property is only used when the OAuth1 property equals true.

The HTTP password for pages requiring a login/password. Chilkat HTTP can do Basic, Digest, and NTLM HTTP authentication. (NTLM is also known as SPA (or Windows Integrated Authentication). To use Basic authentication, the BasicAuth property must be set equal to true. It is not necessary to set the NtlmAuth or DigestAuth properties beforehand if NTLM or Digest authentication is needed. However, it is most efficient to pre-set these properties when the type of authentication is known in advance.

Note: When the Login and Password properties are set, and the type of authentication is specified by setting one of the following properties equal to true (BasicAuth, DigestAuth, NtlmAuth), Chilkat will automatically add the Authorization: ... header in the correct format.

This property is only valid in programming environment and languages that allow for event callbacks.

Sets the value to be defined as 100% complete for the purpose of PercentDone event callbacks. The defaut value of 100 means that at most 100 event PercentDone callbacks will occur in a method that (1) is event enabled and (2) is such that it is possible to measure progress as a percentage completed. This property may be set to larger numbers to get more fine-grained PercentDone callbacks. For example, setting this property equal to 1000 will provide callbacks with .1 percent granularity. For example, a value of 453 would indicate 45.3% competed. This property is clamped to a minimum value of 10, and a maximum value of 100000.

If true, then use IPv6 over IPv4 when both are supported for a particular domain. The default value of this property is false, which will choose IPv4 over IPv6.

Set this to basic if you know in advance that Basic authentication is to be used for the HTTP proxy. Otherwise leave this property unset. Note: It is not necessary to set this property. The HTTP component will automatically handle proxy authentication for any of the supported authentication methods: NTLM, Digest, or Basic. Setting this property equal to basic prevents the 407 response which is automatically handled internal to Chilkat and never seen by your application.

Note: If NTLM authentication does not succeed, set the Global.DefaultNtlmVersion property equal to 1 and then retry.

Set to true if the proxy server expects a direct TLS connection. (This is where the initial connection to the HTTP proxy server is TLS. See Squid Direct TLS Connection. The default value of this property is false.

The domain name of a proxy host if an HTTP proxy is used. This can also be set to an IP address.

If an HTTP proxy is used and it requires authentication, this property specifies the HTTP proxy login.

The NTLM authentication domain (optional) if NTLM authentication is used.

If an HTTP proxy is used and it requires authentication, this property specifies the HTTP proxy password.

The port number of a proxy server if an HTTP proxy is used.

The amount of time in seconds to wait before timing out when reading from an HTTP server. The ReadTimeout is the amount of time that needs to elapse while no additional data is forthcoming. During a long download, if the data stream halts for more than this amount, it will timeout. Otherwise, there is no limit on the length of time for the entire download.

The default value is 60 seconds. Note: Prior to v9.5.0.76, the default was 20 seconds.

Indicates whether the last HTTPS connection received a TLS CertificateRequest handshake message indicating that the server may require a client certificate.

Indicates the HTTP verb, such as GET, POST, PUT, etc. to be used for a redirect when the FollowRedirects property is set to true. The default value of this property is GET. This will produce the same behavior as a web browser (such as FireFox). If this property is set to the empty string, then it will cause the same verb as the original HTTP request to be used.

Note: Prior to version 9.5.0.44, the default value of this property was the empty string.

If set, then any HTTP response to any POST or GET, including downloads, will be rejected if the content-type in the response header does not match this setting. If the content-type does not match, only the header of the HTTP response is read, the connection to the HTTP server is closed, and the remainder of the response is never read.

This property is empty (zero-length string) by default.

Some typical content-types are text/html, text/xml, image/gif, image/jpeg, application/zip, application/msword, application/pdf, etc.

If true, then the hostname/domain in the URL must match at least one of the entries in the server certificate's SAN. A SAN (Subject Alternative Name) field in an SSL/TLS certificate contains a list of additional domain names, subdomains, IP addresses, or other identifiers that the certificate is valid for.

In actuality, it is the SNI hostname in the TLS handshake that must match a SAN entry. By default, Chilkat uses the hostname from the URL as the SNI hostname. An application can explicitly set the SNI hostname via the SniHostname property, which would be typical if connecting via an IP address. See the example below.

Starting in v11.7.0, a wildcard SAN entry is matched as RFC 9525 (formerly RFC 6125) specifies. The wildcard must be the entire left-most label (*.example.com) and stands for exactly one label: *.example.com matches www.example.com, but not a.b.example.com and not the bare example.com. (Earlier versions matched the bare domain, and accepted a wildcard in any position.) A wildcard is not accepted directly under a top-level domain or a country-code second level such as co.uk, and never matches an IP address.

The default value is false.

If true, then the HTTP client will verify the server's SSL certificate. The certificate is expired, or if the cert's signature is invalid, the connection is not allowed. The default value of this property is false.

If this property is true, cookies are automatically persisted to XML files in the directory specified by the CookiesDir property (or in memory if CookieDir = memory). Both CookiesDir and SaveCookies must be set for cookies to be persisted.

The buffer size to be used with the underlying TCP/IP socket for sending. The default value is 65535.

If true, then cookies previously persisted to the CookiesDir are automatically added to all HTTP requests. Only cookies matching the domain and path are added.

Enables file-based session logging. If set to a filename (or relative/absolute filepath), then the exact HTTP requests and responses are logged to a file. The file is created if it does not already exist, otherwise it is appended.

Sets the SNI hostname for the TLS ClientHello. This property is usually necessary only when the domain is specified by an IP address and an SNI hostname is required. By default Chilkat uses the hostname in the URL for the SNI hostname in the TLS ClientHello extension automatically.

The SOCKS4/SOCKS5 hostname or IPv4 address (in dotted decimal notation). This property is only used if the SocksVersion property is set to 4 or 5).

The SOCKS5 password (if required). The SOCKS4 protocol does not include the use of a password, so this does not apply to SOCKS4.

The SOCKS4/SOCKS5 proxy port. The default value is 1080. This property only applies if a SOCKS proxy is used (if the SocksVersion property is set to 4 or 5).

The SOCKS4/SOCKS5 proxy username. This property is only used if the SocksVersion property is set to 4 or 5).

SocksVersion May be set to one of the following integer values:

0 - No SOCKS proxy is used. This is the default.
4 - Connect via a SOCKS4 proxy.
5 - Connect via a SOCKS5 proxy.

Sets the receive buffer size socket option. Normally, this property should be left unchanged. The default value is 4194304.

This property can be increased if download performance seems slow. It is recommended to be a multiple of 4096.

Sets the send buffer size socket option. Normally, this property should be left unchanged. The default value is 262144.

This property can be increased if upload performance seems slow. It is recommended to be a multiple of 4096. Testing with sizes such as 512K and 1MB is reasonable.

Provides a means for setting a list of ciphers that are allowed for SSL/TLS connections. The default (empty string) indicates that all implemented ciphers are possible. The TLS ciphers supported in Chilkat v9.5.0.55 and later are:

TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA256
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5
TLS_DHE_RSA_WITH_DES_CBC_SHA
TLS_RSA_WITH_DES_CBC_SHA

The property can also disallow connections with servers having certificates with RSA keys less than a certain size. By default, server certificates having RSA keys of 512 bits or greater are allowed. Add the keyword rsa1024 to disallow connections with servers having keys smaller than 1024 bits. Add the keyword rsa2048 to disallow connections with servers having keys smaller than 2048 bits.

Note: Prior to Chilkat v9.5.0.55, it was not possible to explicitly list allowed cipher suites. The deprecated means for indicating allowed ciphers was both incomplete and unprecise. For example, the following keywords could be listed to allow matching ciphers: aes256-cbc, aes128-cbc, 3des-cbc, and rc4. These keywords will still be recognized, but programs should be updated to explicitly list the allowed ciphers.

secure-renegotiation: Starting in Chilkat v9.5.0.55, the keyword secure-renegotiation may be added to require that all renegotions be done securely (as per RFC 5746).

best-practices: Starting in Chilkat v9.5.0.55, this property may be set to the single keyword best-practices. This will allow ciphers based on the current best practices. As new versions of Chilkat are released, the best practices may change. Changes will be noted here. The current best practices are:

• If the server uses an RSA key, it must be 1024 bits or greater.
• All renegotations must be secure renegotiations.
• All ciphers using RC4, DES, or 3DES are disallowed.

Example: The following string would restrict to 2 specific cipher suites, require RSA keys to be 1024 bits or greater, and require secure renegotiations: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, rsa1024, secure-renegotiation

Selects the SSL/TLS protocol version to be used for connections. Possible values are:

default
TLS 1.3
TLS 1.2
TLS 1.1
TLS 1.0
SSL 3.0
TLS 1.3 or higher
TLS 1.2 or higher
TLS 1.1 or higher
TLS 1.0 or higher

Allows for the HTTP response body to be streamed directly into a file. If this property is set, then any method returning an HTTP response object will stream the response body directly to the file path specified. The HTTP response object will still contain the response header. (This property is useful when the HTTP response is too large to fit into memory.)

Contains the current or last negotiated TLS cipher suite. If no TLS connection has yet to be established, or if a connection as attempted and failed, then this will be empty. A sample cipher suite string looks like this: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256.

Specifies a set of pins for Public Key Pinning for TLS connections. This property lists the expected SPKI fingerprints for the server certificates. If the server's certificate (sent during the TLS handshake) does not match any of the SPKI fingerprints, then the TLS handshake is aborted and the connection fails. The format of this string property is as follows:

hash_algorithm, encoding, SPKI_fingerprint_1, SPKI_fingerprint_2, ...

"sha256, base64, lKg1SIqyhPSK19tlPbjl8s02yChsVTDklQpkMCHvsTE="

"sha256, base64, 4t37LpnGmrMEAG8HEz9yIrnvJV2euVRwCLb9EH5WZyI=, 68b0G5iqMvWVWvUCjMuhLEyekM5729PadtnU5tdXZKs="

The following encodings are allowed: base64, hex, and any of the encodings indicated in the link below.

Contains the current or last negotiated TLS protocol version. If no TLS connection has yet to be established, or if a connection as attempted and failed, then this will be empty. Possible values are SSL 3.0, TLS 1.0, TLS 1.1, TLS 1.2, and TLS 1.3.

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty. Can be set to a list of the following comma separated keywords:

• QuickDisconnect - Introduced in v9.5.0.77. In the call to CloseAllConnections, do not disconnect cleanly. Instead just disconnect as quickly as possible.
• ProtectFromVpn - Introduced in v9.5.0.80. On Android systems, will bypass any VPN that may be installed or active.
• TlsNoClientRootCert - Introduced in v9.5.0.82. Will exclude root CA certs from being included in the client certificate chain that is sent to the server for client-side authentication. This must be set prior to calling SetSslClientCert.
• AllowEmptyHeaders - Introduced in v9.5.0.82. If present, an empty value string passed to SetHeaderField will cause the header to be added with an empty value. Otherwise, for historical purposes and backward compatibility, the header field is removed when an empty value string is passed.
• AnsiLogin - Introduced in v9.5.0.87. For HTTP basic authentication, the login and password is sent using the utf-8 byte representation. Some servers expect the ANSI byte representation (typically Windows-1252). Use this keyword to send the login/password using ANSI.

Set this property to true to automatically updated with HTTP GET request responses. Only HTTP GET requests are cached. HTTP responses containing Set-Cookie headers are never cached. The default value is false.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

If true, the proxy address/port used by Internet Explorer will also be used by Chilkat HTTP. Note: This property only pays attention to the proxy address and port, and does not pay attention to additional information such as IE proxy server exceptions.

This property sets the User-Agent header for all HTTP requests, except those sent by the HttpReq and HttpSReq methods that use headers from an HttpRequest object.

By default, it is set to an empty string, meaning no User-Agent header is included.

Setting this property is the same as calling SetRequestHeader with User-Agent as the header field name.

The User-Agent HTTP header is sent by the client to identify the software making the request (browser, app, library, bot, etc.).

Example:

MyApp/1.1

Note: Some web servers reject requests that do not include a User-Agent.

If set to true, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is false. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.

Version of the component/library, such as "10.1.0"

This shows whether the last HTTP request automatically followed a redirect. For more information on redirection, see the FollowRedirects and FinalRedirectUrl properties.

Disk caching operates similarly to browser caching of web pages, but it focuses on downloading web pages rather than handling HTTP requests to a REST API.

To activate disk caching, invoke the method at least once. Use the AddCacheRoot method and provide a file path (e.g., D:\MyHttpCache\) to set the root directory. To distribute the cache over multiple directories, call AddCacheRoot multiple times with different directory paths.

HTTP GET web page caching properties and methods include: NumCacheRoots, NumCacheLevels, AddCacheRoot, FetchFromCache, UpdateCache, MinFreshPeriod, MaxFreshPeriod, FreshnessAlgorithm, DefaultFreshPeriod, LMFactor, IgnoreMustRevalidate, IgnoreNoCache, and LastFromCache.

Removes all headers set by the SetRequestHeader method.

Clears all in-memory cookies accumulated while the SaveCookies property was set to true and the CookieDir was set to memory.

Removes all URL variable values previously set by SetUrlVar .

Closes all remaining open HTTP connections.

An HTTP object can hold up to 10 connections. If a server response lacks a Connection: Close header, the connection stays open and may be reused for subsequent requests to the same host. Connections are identified by their IP address or domain name as specified in the URL. Once the limit of 10 connections is reached, the least recently used connection will be closed to open a new one.

Also see: MaxConnections .

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Generates an OCSP request for one or more certificates using JSON (request_details) that specifies the request details. Refer to the examples in the provided links for guidance on constructing the JSON. Note: After creating the OCSP request, send it to the server using HttpBd with a POST request and a Content-Type of application/ocsp-request. Use ParseOcspReply to analyze the OCSP response.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Creates an RFC 3161 time-stamp request and returns the binary request token in timestamp_token. The hash_alg can be sha1, sha256, sha384, sha512, or md5, The hash_val is the base64 hash of the data to be timestamped. The optional req_policy_oid is the requested policy OID in a format such as 1.3.6.1.4.1.47272.1.2. The add_nonce indicates whether to auto-generate and include a nonce in the request. It may be true or false. The req_tsa_cert determines whether or not to request the TSA's certificate (true = Yes, false = No).

Note: After creating the timestamp request, send it to the server using HttpBd with a POST request and a Content-Type of application/timestamp-query. Use VerifyTimestampReply to analyze and verify the timestamp reply. See the examples linked below.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This function clears the Chilkat in-memory DNS cache, which stores hostname-to-IP address mappings to avoid repeated DNS lookups.

Note:

• The DNS cache is shared across all Chilkat objects, so clearing it will impact all such objects.
• Chilkat's DNS caching respects the TTL (time to live) of DNS records. If the TTL has expired since the initial lookup, Chilkat will perform a new DNS query and update the cache with the latest IP address.

Downloads the content at the specified url and saves to a local file at local_file_path.

The download succeeds if the HTTP response status code is in the 200s. If unsuccessful, no output file is created. If the KeepResponseBody property is set to true, the server's error response will be available in the LastResponseBody property.

The response status code will be available in the LastStatus property.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Downloads the content at the specified url and appends to the local file at append_to_path. The file is created if it does not yet exist.

The download succeeds if the HTTP status code is in the 200s. If unsuccessful, no output file is created. If the KeepResponseBody property is set to true, the server's error response will be available in the LastResponseBody property.

The response status code will be available in the LastStatus property.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Downloads content from url to bin_data, clearing bin_data beforehand. bin_data will only contain the downloaded bytes if the operation is successful.

The download succeeds if the HTTP status code is in the 200s. If unsuccessful, nothing is written to bin_data. If the KeepResponseBody property is set to true, the server's error response will be available in the LastResponseBody property.

The response status code will be available in the LastStatus property.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Fetches the content at url and returns the encoded hash using the specified algorithm (hash_algorithm: sha1, sha256, sha384, sha512, md2, md5, haval, ripemd128, ripemd160, ripemd256, or ripemd320), and returns the hash encoded in the specified encoding (encoding: Base64, modBase64, Base32, UU, QP for quoted-printable, URL for URL-encoding, Hex, Q, B, url_oath, url_rfc1738, url_rfc2396, or url_rfc3986).

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Downloads the content at the url into a Chilkat StringBuilder object. The charset tells Chilkat how to interpret the bytes received. The sb is appended with the downloaded text data.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This is a convenience method for extracting the META refresh URL from HTML. For example, if the html_content contains a META refresh tag, such as:

<meta http-equiv="refresh" content="5;URL='https://example.com/'">

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Obtains a Google API OAuth2 access token for a service account. The iss is your service account email address ending in gserviceaccount.com. The scope should be set to https://mail.google.com/ for GMail. The sub_email is your company email address, e.g. bob@yourcompany.com. num_sec is the number of seconds the access token will remain valid.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This method is similar to G_SvcOauthAccessToken, but offers greater customization. The first three arguments of G_SvcOauthAccessToken are replaced with claim_params to allow for future expansion with name-value parameters. See the example below.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Returns the current date and time in GMT (UTC) as a string formatted according to RFC 2616: Day, DD Mon YYYY HH:MM:SS GMT. For example, Thu, 21 Aug 2025 11:17:31 GMT.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Returns the Nth cache root, with indexing starting at 0. Cache roots are established by calling AddCacheRoot one or more times. The number of established cache roots is in the NumCacheRoots property.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Returns cookies in XML format for a specified domain. Cookies are saved only if the SaveCookies property is set to true. If the CookieDir property is set to memory, cookies are stored in-memory.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Utility method to extract the domain name from a URL. For instance, passing in https://chilkatsoft.com/refdoc/csharp.asp will return chilkatsoft.com.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Offers details about the most recent method called on this object instance, although some methods may not supply any information.

Returns the value of a header field previously set by calling SetRequestHeader.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Establishes an SSL/TLS connection with a web server to acquire its SSL certificate without retrieving any data, then disconnects.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Returns the path part of a URL. For example, the path part of https://example.com/folder/page?lang=en&sort=asc#section2 is /folder/page.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Returns true if the header field specified by name is included in all HTTP requests, except those sent by the HttpReq or HttpSReq methods.

Returns true or false: an answer, not a success flag.

Sends an HTTP request to url using the specified HTTP verb (e.g., POST, PUT, PATCH). The body of the request is defined by bd, and the Content-Type header is set by content_type, with possible values like application/octet-stream, application/pdf, image/jpeg, or application/zip. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to url using the specified HTTP verb (e.g., POST, PUT, PATCH). The body of the request is streamed directly from local_file_path, and the Content-Type header is set by content_type, with possible values like application/octet-stream, application/pdf, image/jpeg, or application/zip. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to url using the specified method in verb (e.g., POST, PUT, PATCH). The request body contains the JSON from json, with the content type set by content_type, such as application/json or application/jsonrequest. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to url using the specified HTTP verb. The request body is empty. Verbs like GET, HEAD, and DELETE usually do not include a body. No Content-Type header is included because there is no content in the body of the request. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP verb request to url with query parameters from json. The request has an empty body, and therefore, no Content-Type header is included. Typically, verbs such as GET, HEAD, and DELETE do not require a body. Applications generally call this method with url, while passing query parameters separately in json. See the example below. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to url where the content of the request is defined by request. The path and query part of target is taken from the url instead of the path property within request.

scheme   host       path             query    
┌────┐  ┌─────────┐┌──────────────┐ ┌────────┐ 
https://example.com/docs/index.html?search=test

The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to url using the specified verb (e.g., POST, PUT, PATCH). The request body contains the text passed in sb, and the content type is specified by content_type (e.g., text/xml, application/json). The charset defines the text encoding, such as utf-8 or iso-8859-1. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to web server at domain:port using TLS if ssl equals true. The content of the request, including the path part of the URL, query params, additional headers, and request body is defined by request.

Note: The domain should include only the domain (host), not the complete URL. The path and query params are defined in the request object.

scheme   host       path             query    
┌────┐  ┌─────────┐┌──────────────┐ ┌────────┐ 
https://example.com/docs/index.html?search=test

response contains the HTTP response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sends an HTTP request to url using the specified verb (e.g., POST, PUT, PATCH). The request body contains the text passed in body_str, and the content type is specified by content_type (e.g., text/xml, application/json). The charset defines the text encoding, such as utf-8 or iso-8859-1. The HTTP response is returned in response.

This method returns false for HTTP response status codes of 400 or higher, but the response object is still provided in response. If response's status code is 0, it indicates no response was received due to a communication error or another issue. In such cases, check the LastErrorText property for details.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Gets the server certificate at a domain:port and then sends an OCSP request to the certificate's OCSP URL to determine if the certificate has been revoked. Returns the OCSP status, which has one of the following values:

• -1: Unable to check. See the contents of the LastErrorText property for more informaiton.
• 0: Good
• 1: Revoked
• 2: Unknown

Parses an OCSP reply. Returns the following possible integer values:

• -1: The ocsp_reply does not contain a valid OCSP reply.
• 0: Successful - Response has valid confirmations..
• 1: Malformed request - Illegal confirmation request.
• 2: Internal error - Internal error in issuer.
• 3: Try later - Try again later.
• 4: Not used - This value is never returned.
• 5: Sig required - Must sign the request.
• 6: Unauthorized - Request unauthorized.

The binaryOCSP reply is provided in ocsp_reply. The reply_data is populated with data parsed from ocsp_reply.

OCSP requests are created by calling CreateOcspRequest .

This function sends an HTTP DELETE request to a specified URL and returns the response body as a string.

The HTTP response code is stored in the LastStatus property, while additional response details are available in properties such as LastResponseHeader , LastResponseBody , LastModDate , and LastContentType .

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This function sends an HTTP GET request to a specified URL, which can include query parameters, and returns the binary response body in bin_data.

The HTTP response code is stored in the LastStatus property. Additional response details can be found in properties like LastResponseHeader , LastModDate , and LastContentType .

A response code of 400 or higher indicates a failure. If the error response is text-based and the KeepResponseBody property is true, it will be available in the LastResponseBody property.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This function sends an HTTP GET request to a specified URL, which can include query parameters, and returns the text response body in sb_content. The existing content of sb_content, if any, is cleared and replaced with the downloaded content.

The response status code is stored in the LastStatus property. Additional response details can be found in properties like LastResponseHeader , LastModDate , and LastContentType .

If the response status code is >= 400, then this method returns false, but the body of the HTTP response is still returned in sb_content. This allows for the application to examine the response body for cases where an error is returned, but the expected content is not received.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This function sends an HTTP GET request to a specified URL, which can include query parameters, and returns the text response body.

The response status code is stored in the LastStatus property. Additional response details can be found in properties like LastResponseHeader , LastModDate , and LastContentType .

A response code of 400 or higher indicates a failure. If the error response is text-based and the KeepResponseBody property is true, it will be available in the LastResponseBody property.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Eliminates a header field from being included in all HTTP requests, except for those sent by the HttpReq and HttpSReq methods, which rely on header fields provided in an HttpRequest object via method arguments.

Builds the GET request that would be sent if a method such as QuickGetStr was called. Instead of sending the request, it returns the HTTP request that would have been sent.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Resumes downloading content from url and saves it to a partially completed local file at target_filename. If the file at target_filename doesn't exist or is empty, this method functions the same as Download .

The download succeeds if the HTTP response status code is in the 200s. If unsuccessful, no output file is created. If the KeepResponseBody property is set to true, the server's error response will be available in the LastResponseBody property.

The response status code will be available in the LastStatus property.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Resumes a download from where it left off, determined by the number of bytes in bin_data. This method can be called multiple times until the download is complete.

The download succeeds if the HTTP response status code is in the 200s. If unsuccessful, no output file is created. If the KeepResponseBody property is set to true, the server's error response will be available in the LastResponseBody property.

The response status code will be available in the LastStatus property.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Creates a new Amazon S3 bucket.

Note: You can add x-amz-* headers, including metadata, to any S3 request by using SetRequestHeader for each header. This applies to all S3 methods, even if not explicitly mentioned.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Deletes an Amazon S3 bucket.

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Deletes a remote file (object) on the Amazon S3 service.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Deletes several objects from a bucket with a single request. object_names includes the object names (or keys) to be deleted. To delete a specific object version, add a versionId to the object name, like this: SampleDocument.txt; VersionId=OYcLXagmS.WaD..oyH4KRguB95_YhLs7. If successful, json_response will contain the JSON response.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Downloads a file from the Amazon S3 service into bd.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Downloads a file from the Amazon S3 service.

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Downloads a text file (object) from the Amazon S3 service and returns the content as a string. The charset specifies the character encoding, such as utf-8, of the remote text object.

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Checks the existence of a remote file, returning:

• 1 if the file exists
• 0 if the file does not exist
• -1 if the check failed
• 2 if in asynchronous mode, indicating the background task started successfully

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

This method generates a temporary pre-signed URL for Amazon S3. Before calling this method, ensure the following properties are set to valid values: AwsSecretKey , AwsAccessKey , and AwsRegion . If the endpoint differs from s3.amazonaws.com, set the AwsEndpoint property accordingly.

http_verb is the HTTP verb (e.g., GET, PUT, POST, DELETE). aws_service is the name of the AWS service (e.g., s3, s3-accelerate). If use_https is true, the returned URL will start with https://; otherwise, it will start with http://.

The generated URL has this format:

https://<AwsEndpoint>/<bucket_name>/<path>
?X-Amz-Algorithm=AWS4-HMAC-SHA256
&X-Amz-Credential=<AwsAccessKey>/<currentDate>/<AwsRegion>/<awsService>/aws4_request
&X-Amz-Date=<currentDateTime>
&X-Amz-Expires=<numSecondsValid>
&X-Amz-SignedHeaders=host
&X-Amz-Signature=<signature-value>  

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Retrieve an XML-formatted list of objects in an Amazon S3 bucket, similar to a directory listing.

bucket_path can include URL-encoded parameters. For example, to list objects in a bucket named ChilkatABC with a max-keys value of 2000 and a marker of xyz, pass the following string as bucket_path to the S3_ListBucketObjects method: ChilkatABC?max-keys=2000&marker=xyz

This method recognizes all parameters listed in the AWS documentation for bucket object listing: delimiter, marker, max-keys, and prefix. For further details, refer to Amazon's AWS online documentation.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Retrieves the XML listing of the buckets for an Amazon S3 account.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Uploads the contents of bd as a file to the Amazon S3 service.

Note: x-amz-* headers, including metadata, can be added to any S3 request by adding each header with a call to SetRequestHeader . This applies to all S3 methods, even if not explicitly stated.

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Uploads a file to the Amazon S3 service.

Note: x-amz-* headers, including metadata, can be added to any S3 request by adding each header with a call to SetRequestHeader . This applies to all S3 methods, even if not explicitly stated.

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Uploads the content of object_content as a file to Amazon S3. charset specifies the string's character encoding (byte representation).

Note: x-amz-* headers, including metadata, can be added to any S3 request by adding each header with a call to SetRequestHeader . This applies to all S3 methods, even if not explicitly stated.

Note: Ensure the AwsEndpoint property is set to the correct region if the bucket is outside us-east-1, for example, eu-central-1. For S3-compatible services like Wasabi, always set the AwsEndpoint , such as s3.wasabisys.com or s3.eu-central-1.wasabisys.com.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sets the private key to be used with some forms of authentication. For example, this is used automatically add the Authorization header (Signature) for Amazon Pay requests.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sets the AuthToken property. The sb contains the OAuth2 access token to be used.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sets the private key for private_key_jwt client authentication (RFC 7523) in the OAuth2 client credentials flow of the AuthToken property. When the AuthToken is set to JSON with the client credentials, Chilkat creates a new client_assertion JWT, signed with this key, for each token request, and sends it with client_assertion_type set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer. The JWT has the claims iss and sub (the client_id from the JSON), aud (the token_endpoint), iat, exp (5 minutes after iat) and a unique jti.

kid is the key ID, which is put in the JWT header. Pass an empty string if the authorization server does not need one. The key can be an EC key on the P-256, P-384 or P-521 curve (the JWT is signed with ES256, ES384 or ES512), an RSA key of 2048 bits or more (RS256), or an Ed25519 key (EdDSA). For example, load a key in JWK format with PrivateKey.LoadJwk and pass its kid.

This is typically used with SetDPoPKey, when the authorization server requires both a client assertion and DPoP. The same key may be passed to both methods if the server allows it. A client_assertion or client_assertion_type member in the AuthToken JSON is ignored once this key is set. The JSON must include the client_id.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This method restores cookies for a specified domain. It requires that the cookies, previously obtained using the GetCookieXml method, are stored in a persistent storage like a database or file. An application can then restore these cookies using this method.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sets the private key for automatically adding the DPoP header to HTTP requests. Chilkat will generate a JWT (a DPoP proof) for each request and include the DPoP header. Ensure the AuthToken property is also set.

The key can be an EC key on the P-256, P-384 or P-521 curve (the proof is signed with ES256, ES384 or ES512), an RSA key of 2048 bits or more (RS256), or an Ed25519 key (EdDSA). Before v11.7.0, only EC keys were accepted.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sets the RSA key to be used with OAuth 1.0a authentication when the OAuthSigMethod is RSA-SHA256 or RSA-SHA1.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Adds a header field to be included in all HTTP requests, except for those sent by the HttpReq and HttpSReq methods, which rely on header fields provided in an HttpRequest object via method arguments. If the header field already exists, it is replaced.

Use the RemoveRequestHeader method to delete a specific header. Setting a header field to an empty string will also remove it, unless the AllowEmptyHeaders option in UncommonOptions is used.

Avoid setting the Authorization header manually. Instead, use the appropriate authorization properties such as Password , AuthToken , AuthSignature , BasicAuth , DigestAuth , NtlmAuth , OAuth1 , OAuthToken , etc.

To add cookies, use the Cookie header field format: Cookie: name1=value1; name2=value2; name3=value3.

Do not manually set the Content-Length header. Chilkat will automatically calculate and include Content-Length when sending the HTTP request.

Equivalent to setting the Password property but offers a more secure method by using a secure string object.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Enforces a requirement on the server's certificate. The req_name can be one of the following:

• SubjectDN
• SubjectCN
• IssuerDN
• IssuerCN
• SAN

The req_name specifies the part of the certificate, and the req_value is the value that it must match exactly or with a wildcard (*), for example "*.example.com". If the server's certificate does not match, the SSL / TLS connection is aborted.

Facilitates the use of a client-side certificate for a TLS connection, enabling mutual authentication. In a standard TLS connection, the server alone presents a certificate during the handshake to verify its identity. With mutual TLS (mTLS), the client also presents a trusted certificate, allowing the server to authenticate the client's identity. This process enhances security by adding a layer of verification beyond just usernames, passwords, or tokens.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This is identical to the SetSslClientCert method, but it allows the certificate with a private key to be in PEM format.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This is identical to the SetSslClientCert method, but enables you to provide a certificate with private key directly from a .pfx or .p12 file.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Sets a variable's value for URL substitutions used in any method. Variables are formatted as {$varName} in URLs, such as: https://graph.microsoft.com/v1.0/users/{$id}.

Call ClearUrlVars to unset all URL variables.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This method authenticates with SharePoint Online and if successful, sets a cookie which is used for all following SharePoint HTTP requests. Before using this method, ensure you configure the CookieDir property to either memory or a specific directory path to store the authentication cookie, which will then be automatically used for subsequent HTTP requests.

Using this method automatically sets the SaveCookies and SendCookies properties to true, as these settings are necessary for SharePoint Online authentication.

To use the method, provide the following arguments:

• site_url: The URL, e.g., https://yourdomain.sharepoint.com/
• username: An email address, e.g., username@yourdomain.com
• password: The Sharepoint password.
• extra_info: Can be an empty JSON object. Reserved for additional information if needed in the future.

Returns true on success, nil, err on failure. The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

This method makes the calling process sleep for a specified number of milliseconds.

URL decodes a string.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

URL encodes a string.

Returns the string, or nil, err on failure (or when nothing is found). The second return value, err, is the object's last_error_text; wrap the call in assert() to raise an error instead.

Verifies a timestamp reply received from a timestamp authority (TSA). Returns the following possible integer values:

• -1: The timestamp_reply does not contain a valid timestamp reply.
• -2: The timestamp_reply is a valid timestamp reply, but failed verification using the public key of the tsa_cert.
• 0: Granted and verified.
• 1: Granted and verified, with mods (see RFC 3161)
• 2: Rejected.
• 3: Waiting.
• 4: Revocation Warning
• 5: Revocation Notification

If the timestamp reply (timestamp_reply) is known to be from a trusted source, then the tsa_cert may be empty. If tsa_cert is empty (never loaded with a certificate), then the verification will use the certificate embedded in the timestamp reply.

The CreateTimestampRequest method is used to create a timestamp request.

Enables a method call to be aborted by triggering the AbortCheck event at intervals defined by the HeartbeatMs property. If HeartbeatMs is set to its default value of 0, no events will occur. For instance, set HeartbeatMs to 200 to trigger 5 AbortCheck events per second.

Example

local deadline = os.time() + 30                  -- give up after 30 seconds
http.heartbeat_ms = 250                      -- call the handler 4 times per second
http:set_event_handler({ abort_check = function() return os.time() > deadline end })

This provides the percentage completion for any method involving network communications or time-consuming processing, assuming the progress can be measured as a percentage. This event is triggered only when it's possible and logical to express the operation's progress as a percentage. The pctDone argument will range from 1 to 100. For methods that finish quickly, the number of PercentDone callbacks may vary, but the final callback will have pctDone equal to 100. For longer operations, callbacks will not exceed one per percentage point (e.g., 1, 2, 3, ..., 98, 99, 100).

The PercentDone callback also acts as an AbortCheck event. For fast methods where PercentDone fires, an AbortCheck event may not trigger since the PercentDone callback already provides an opportunity to abort. For longer operations, where time between PercentDone callbacks is extended, AbortCheck callbacks enable more responsive operation termination.

To abort the operation, set the abort output argument to true. This will cause the method to terminate and return a failure status or corresponding failure value.

Example

http:set_event_handler({
    percent_done = function(pct_done)     -- 0 to 100
        print("Percent done: " .. pct_done)
        return false                       -- return true to abort the method in progress
    end,
})

This event callback provides tag name/value pairs that detail what occurs during a method call. To discover existing tag names, create code to handle the event, emit the pairs, and review them. Most tag names are self-explanatory.

Note: Some Chilkat methods don't fire any ProgressInfo events.

Example

http:set_event_handler({
    progress_info = function(name, value) print(name .. ": " .. value) end,
})