I have a winforms client application that uses HttpClient to connect to a WebApi2 app. I'm currently testing locally so the server starts using IIS Express 10.
The server app allows anonymous and also windows authentication. Every controller has the Authorize attribute.
The HttpClient is set up as follows:
WebRequestHandler handler = new WebRequestHandler()
{
AllowAutoRedirect = false,
AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate,
CookieContainer = cookieContainer,
Credentionals = new NetworkCredential(username, password),
UseCookies = true,
UseDefaultCredentials = true,
UseProxy = false,
};
client = new HttpClient(handler, true)
{
BaseAddress = new Uri(myUrl)
};
And to make sure, I also do:
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", Convert.ToBase64String(ASCIIEncoding.ASCII.GetBytes(string.Format("{0}:{1}", Credentials.UserName, Credentials.Password))));
The application works fine, however the following is a snippet of the log being generated by IIS Express:
10:51:11 ::1 POST /myserver/Login - 55567 - ::1 - - 401 0 0 389
10:51:17 ::1 POST /myserver/Login - 55567 MicrosoftAccount\myemail@here.com ::1 - - 200 0 0 5760
10:51:51 ::1 POST /myserver/SearchFor itemType=38 55567 - ::1 - - 401 0 0 347
10:51:52 ::1 POST /myserver/SearchFor itemType=38 55567 MicrosoftAccount\myemail@here.com ::1 - - 200 0 0 815
10:51:55 ::1 GET /myserver/CustomerType/174 - 55567 - ::1 - - 401 0 0 400
10:51:55 ::1 GET /myserver/CustomerType/174 - 55567 MicrosoftAccount\myemail@here.com ::1 - - 200 0 0 574
For every request there's a 401 then a '200' code. I'm not explicitly setting the WWW-Authenticate header when sending the request.
How can I determine what kind of challenge the server is sending to the client?
EDIT
I've changed the initialization of HttpClient as follows:
var uri = new Uri(myUrl);
var credentialCache = new CredentialCache();
credentialCache.Add(new Uri(uri.GetLeftPart(UriPartial.Authority)), "NTLM", credentials);
WebRequestHandler handler = new WebRequestHandler()
{
AuthenticationLevel = AuthenticationLevel.MutualAuthRequested,
AutomaticDecompression = DecompressionMethods.GZip | DecompressionMethods.Deflate,
Credentials = credentialCache,
PreAuthenticate = true,
};
client = new HttpClient(handler, true)
{
BaseAddress = uri
};
On GET requests I always get a 401 followed by a 200 response. On other requests (POST, PATCH) there is only the 200 which I assume the client sent the authentication header correctly.
Why am I still getting a 401 on GET requests?
