title: Why are my ASP.NET pages returning `200 OK` without any authentication headers being sent?
body: <h3>Note:</h3>
  <blockquote>
  <p>This question has broadened in scope from previous revisions. I have tried to simplify the issue so it can be easily reproduced by anyone.</p>
  </blockquote>
  <p>Using <a href="http://www.fiddler2.com/fiddler2/" rel="nofollow noreferrer">Fiddler</a>, I can replay an arbitrary request to my default page after erasing my <code>Authorization</code> header from the HTTP request, and I am able to get a response of <code>200 OK</code> with valid data.</p>
  <h3>Bounty Update</h3>
  <p>Here are the steps to reproduce this exact behavior:</p>
  <p><strong>1.</strong> Create a &quot;New Website&quot; in ASP.NET, feel free to name it &quot;InsecureWebsite&quot;</p>
  <p><strong>2.</strong> Edit <code>web.config</code> to deny all unauthenticated users:</p>
  <pre><code>&lt;authentication mode=&quot;Windows&quot; /&gt;
    &lt;authorization&gt;
      &lt;deny users=&quot;?&quot;/&gt;
    &lt;allow users=&quot;*&quot;/&gt;
  &lt;/authorization&gt;
  </code></pre>
  <p><strong>3.</strong> Publish the website to an arbitrary directory on a DEV server and create a virtual directory for the application</p>
  <p><strong>4.</strong> Ensure the application has script access (.ASP) and Integrated Windows Authentication enabled</p>
  <p><strong>5.</strong> Open <a href="http://www.fiddler2.com/fiddler2/" rel="nofollow noreferrer">Fiddler</a> to capture the traffic</p>
  <p><strong>6.</strong> Load the page in your favorite browser and look at the &quot;Inspectors&quot; tab within <a href="http://www.fiddler2.com/fiddler2/" rel="nofollow noreferrer">Fiddler</a>, you'll see a request similar to:</p>
  <pre>
  GET /InsecureWebsite/ HTTP/1.1
  Host: dev.subdomain.example.com
  User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-us,en;q=0.5
  Accept-Encoding: gzip,deflate
  Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
  Keep-Alive: 300
  Connection: keep-alive
  Authorization: NTLM
  {Base64-encoded authentication data}
  </pre>
  <p>The initial request to <code>Default.aspx</code> will return a <code>401 Unauthorized</code>, will go into negotiation, and then finally return a <code>200 OK</code>.</p>
  <p>In Fiddler I can then erase the <code>Authorization</code> header directly from a replayed request to <code>Default.aspx</code> and still get a <code>200 OK</code>. How is that possible?</p>
  <h2>Solution</h2>
  <p>It turns out that Fiddler uses the same underlying connection when making the requests, so once the connection is authenticated, any request on the same connection will also be authenticated as the same user as the initial request. You can turn this feature off in Fiddler here:</p>
  <p><a href="http://john.cognitivedelay.com/images/fiddler-options.gif" rel="nofollow noreferrer">Screenshot of Fiddler options http://john.cognitivedelay.com/images/fiddler-options.gif</a></p>
  <p>Once this has been unchecked, any replayed requests from within Fiddler will return a <code>401 Unauthorized</code> as I would expect.</p>
  <p>Thanks to all who offered their time to respond!</p>