What does HRESULT 0x00090366 (SEC_I_CONTINUE_NEEDED_MESSAGE_OK) mean?

SEC_I_CONTINUE_NEEDED_MESSAGE_OK

Security context must continue although early message use is allowed

SEC_I_CONTINUE_NEEDED_MESSAGE_OK is HRESULT 590694 (0x00090366) from winerror.h. The documented description is “The function completed successfully, but must be called again to complete the context; Early start can be used.” The severity bit indicates a nonfailure result, but the value carries a specific condition that must not be collapsed into plain S_OK.

In the SSPI authentication or message-protection state machine, this result means that the function completed successfully, but must be called again to complete the context; Early start can be used. Consumers of it must decide from the API contract whether to stop, wait, continue, or expose a reduced outcome.

Where the status is encountered

• InitializeSecurityContext or AcceptSecurityContext loops; log the exact method and object state instead of interpreting the constant outside that contract.
• Schannel or another security package; log the exact method and object state instead of interpreting the constant outside that contract.
• Message signing, fragmentation, or asynchronous SSPI processing; log the exact method and object state instead of interpreting the constant outside that contract.

What must be true before accepting it

Verify that the application separates early permitted data from authentication completion and still performs every remaining handshake call. Checking the boundary keeps it from hiding stale data, pending work, or a deliberately reduced result.

Do not compensate until the caller knows which sub-operations actually occurred.

Evidence to preserve

• Preserve context attributes and early-start flag.
• Preserve token sent and next token expected.
• Preserve early message identity.
• Preserve authorization deferred until completion.
• Preserve final context status.

Correct handling and recovery

Process only data explicitly allowed by early-start semantics, call the context routine again with the next token, and defer final authorization until the context is complete.

Continuation after it may be appropriate, but an identical restart is not automatically recovery.

Difference from nearby results

Practical scenario

A client receives this status after sending early application data. The server buffers privileged operations and completes the SSPI exchange before committing them.

References

• Microsoft: SSPI status codes — official Microsoft material relevant to this HRESULT.
• Microsoft: SSPI context semantics
• Microsoft: InitializeSecurityContext
• Microsoft: DecryptMessage
• Microsoft: HRESULT values