| Previous | Next |
| SEC_I_MESSAGE_FRAGMENT | SEC_I_ASYNC_CALL_PENDING |
SEC_I_CONTINUE_NEEDED_MESSAGE_OK
Security context must continue although early message use is allowed
SEC_I_CONTINUE_NEEDED_MESSAGE_OK is HRESULT 590694 (0x00090366) from winerror.h. The documented description is “The function completed successfully, but must be called again to complete the context; Early start can be used.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.
In the SSPI authentication or message-protection state machine, this result means that the function completed successfully, but must be called again to complete the context; Early start can be used. Consumers of it must decide from the API contract whether to stop, wait, continue, or expose a reduced outcome.
Where the status is encountered
- InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
- Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
- Message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.
What must be true before accepting it
Verify that the application separates early permitted data from authentication completion and still performs every remaining handshake call. Checking the boundary keeps it from hiding stale data, pending work, or a deliberately reduced result.
Do not compensate until the caller knows which sub-operations actually occurred.
Evidence to preserve
- Preserve context attributes and early-start flag.
- Preserve token sent and next token expected.
- Preserve early message identity.
- Preserve authorization deferred until completion.
- Preserve final context status.
Correct handling and recovery
Process only data explicitly allowed by early-start semantics, call the context routine again with the next token, and defer final authorization until the context is complete.
Continuation after it may be appropriate, but an identical restart is not automatically recovery.
Difference from nearby results
Practical scenario
A client receives this status after sending early application data. The server buffers privileged operations and completes the SSPI exchange before committing them.
References
- Microsoft: SSPI status codes — official Microsoft material relevant to this HRESULT.
- Microsoft: SSPI context semantics
- Microsoft: InitializeSecurityContext
- Microsoft: DecryptMessage
- Microsoft: HRESULT values
Looking for a different code? Search another status or error code.