Indy HTTPS POST Request in Delphi using TLS 1.0 instead of TLS 1.2

When you get an OpenSSL load error from Indy, you can call Indy's WhichFailedToLoad() function in the IdSSLOpenSSLHeaders unit to find out why. Which you are, but you didn't show us what it is actually saying, so we can't diagnose why OpenSSL is failing to load. Typically, the load will fail because either:

• libeay32.dll and/or ssleay32.dll cannot be found. If they are not in the same folder as your program, or at least on the OS' DLL search path, then you can use Indy's IdOpenSSLSetLibPath() function in the IdSSLOpenSSLHeaders unit to tell Indy where to look for them.

• they are a different bitness than your program. A 32bit program cannot load 64bit DLLs, and vice versa.

• they are missing required exported functions, which would indicate that they are likely a version of OpenSSL that Indy simply does not support. For instance, TIdSSLIOHandlerSocketOpenSSL supports only up to OpenSSL 1.0.2u. For OpenSSL 1.1.x+, you need to use this experimental SSLIOHandler instead.

With that said, I see several things wrong with your Post code:

• you are manually encoding input data that you don't need to encode manually at all. TIdHTTP.Post() can handle that internally for you.

• you are calling the version of TIdHTTP.Post() that takes a String filename as input, which will open the specified file and send its content as-is. But you are not passing in a filename, you are passing in your Base64-encoded user credentials (not even your JSON). To make a proper application/x-www-webform-urlencoded post, you need to use the version of TIdHTTP.Post() that takes a TStrings of name=value pairs as input.

• TIdHTTP natively implements Basic authentication, so you should be using the TIdHTTP.Request.UserName and TIdHTTP.Request.Password properties for your user credentials.

• you are telling TIdSSLIOHandlerSocketOpenSSL to use SSL v2.0. Nobody uses that anymore, as it is no longer secure. You should not be using anything less than TLS v1.0 as an absolute minimum. And even that is being phased out on most servers. So make sure you also have TLS v1.1 and TLS v1.1 enabled, too (for TLS v1.3, you need to use the other SSLIOHandler).

Frankly, your Delphi code is not even close to replicating what the Javascript code is doing. Try something more like this instead:

unit uMainForm;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Vcl.StdCtrls, IdBaseComponent, IdSSLOpenSSL, IdSSLOpenSSLHeaders,
  System.NetEncoding, IdComponent, IdTCPConnection, IdTCPClient, IdHTTP;

type
  TMainForm = class(TForm)
    GetBtn: TButton;
    ResponseMemo: TMemo;
    procedure GetBtnClick(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure FormDestroy(Sender: TObject);
  private
    { Private declarations }
    sl: TStringList;
  public
    { Public declarations }
  end;

var
  MainForm: TMainForm;

implementation

{$R *.dfm}

procedure TMainForm.FormCreate(Sender: TObject);
begin
  sl := TStringList.Create;
  sl.Add('locations=[{"address":"Test1","lat":"52.05429","lng":"4.248618"},{"address":"Test2","lat":"52.076892","lng":"4.26975"},{"address":"Test3","lat":"51.669946","lng":"5.61852"},{"address":"Sint-Oedenrode, The Netherlands","lat":"51.589548","lng":"5.432482"}]');
end;

procedure TMainForm.FormDestroy(Sender: TObject);
begin
  sl.Free;
end;

procedure TMainForm.GetBtnClick(Sender: TObject);
var
  LHTTP: TIdHTTP;
  LHandler: TIdSSLIOHandlerSocketOpenSSL;
  responseFromServer, sWhichFail, sVer :string;
begin
  ResponseMemo.Clear;

  LHTTP := TIdHTTP.Create(nil);
  try
    LHandler := TIdSSLIOHandlerSocketOpenSSL.Create(LHTTP);
    LHandler.SSLOptions.SSLVersions := [sslvTLSv1, sslvTLSv1_1, sslvTLSv1_2];
    LHandler.SSLOptions.Mode := sslmClient;
    LHandler.SSLOptions.VerifyMode := [];
    LHandler.SSLOptions.VerifyDepth := 0;

    LHTTP.IOHandler := LHandler;
    LHTTP.AllowCookies := True;
    LHTTP.Request.Accept := 'text/json, */*';
    LHTTP.Request.BasicAuthentication := True;
    LHTTP.Request.Username := 'username';
    LHTTP.Request.Password := 'password';

    LHTTP.HTTPOptions := [hoForceEncodeParams];

    try
      responseFromServer := IdHTTP1.Post('https://api.routexl.com/tour', sl);
      ResponseMemo.Lines.Text := responseFromServer;
    except
      on E: EIdOSSLCouldNotLoadSSLLibrary do
      begin
        sVer := OpenSSLVersion();
        sWhichFail := WhichFailedToLoad();
        ResponseMemo.Lines.Add(sVer);
        ResponseMemo.Lines.Add(sWhichFail);
        ShowMessage('Could not load OpenSSL');
      end;
      on E: EIdHTTPProtocolException do
      begin
        ResponseMemo.Lines.Add(Format('Response Code: %d', [LHTTP.ResponseCode]));
        ResponseMemo.Lines.Add(Format('Response Text: %s', [LHTTP.ResponseText]));
        ResponseMemo.Lines.Add(E.ErrorMessage);
        ShowMessage('HTTP Failure');
      end;
      on E: Exception do
      begin
        ResponseMemo.Lines.Add(E.ClassName);
        ResponseMemo.Lines.Add(E.Message);
        ShowMessage('Unknown Error');
      end;
    end;
  finally
    LHTTP.Free;
  end;
end;

end.

UPDATE: that being said, the API documentation shows the following curl example:

Get an unoptimized route using cURL:

curl \
--url https://api.routexl.com/tour/ \
--user <username>:<password> \
--data 'locations=[{"address":"1","lat":"52.05429","lng":"4.248618"},{"address":"2","lat":"52.076892","lng":"4.26975"},{"address":"3","lat":"51.669946","lng":"5.61852"},{"address":"4","lat":"51.589548","lng":"5.432482"}]&skipOptimisation=true'

That example DOES translate to the above Delphi code, per the curl documentation:

-d, --data

(HTTP MQTT) Sends the specified data in a POST request to the HTTP server, in the same way that a browser does when a user has filled in an HTML form and presses the submit button. This will cause curl to pass the data to the server using the content-type application/x-www-form-urlencoded. Compare to -F, --form.

With the exception of one detail - when sending an application/x-www-form-urlencoded request with the hoForceEncodeParams option enabled, TIdHTTP.Post() will percent-encode the [], {}, ", :, and , characters in the JSON in %HH format. But the API's Javascript and PHP examples on GitHub are not doing that encoding, they send the JSON as-is. So, if it turns out the API server does not like that encoding, then simply disable the hoForceEncodeParams option:

LHTTP.HTTPOptions := [];

You can change declaration of the sLog: String to sLog: TStrings. Then in the onCreate instantiate the sLog := TStringList.Create and then later in code sLog.Text := Base64.Encode(s);.

So,

var
  MainForm: TMainForm;
  ss: TStringStream;
  s, sFile : String;
  sLog: TStrings;
  Base64: TBase64Encoding;
  Txt: TextFile;

procedure TMainForm.FormCreate(Sender: TObject);
begin
  sLog := TStringList.Create;
  // Assign JSON to TStringStream
  ss := TStringStream.Create('locations= [{"address":"Test1","lat":"52.05429","lng":"4.248618"},{"address":"Test2","lat":"52.076892","lng":"4.26975"},{"address":"Test3","lat":"51.669946","lng":"5.61852"},{"address":"Sint-Oedenrode, The Netherlands","lat":"51.589548","lng":"5.432482"}]', TEncoding.UTF8);
  // Base64 encode username and password string to satisfy API for "Authorization", "Basic " + sLog);
  s := 'username:password';
  Base64 := TBase64Encoding.Create(20, '');
  sLog.Text := Base64.Encode(s);
end;