title: unable to authenticate using basic authentication
body: <p>I have an ASP.NET WebApi service that requires http basic authentication (this is for a demonstration, not for production, so that's the reason for basic authentication and not something more secure). The service runs fine with visual studio IIS express server and authentication happens through a custom HTTP module. </p>
  
  <p>It fails and continues to popup a login screen when I deploy the site to the hosting server. I verified with Fiddler that the request is being sent and the credentials are being sent. But it keeps responding with a 401 unauthorized response. It appears that the request credentials are somehow being lost in the time it takes to get from the client to the server. I have spent many, many hours trying to diagnose this and the .NET authentication with Web API and IIS seems very confusing. Please help!! </p>
  
  <p>Outgoing request from Fiddler shows:</p>
  
  <p>GET mywebsiteaddress HTTP/1.1<br>
  Host: my website address<br>
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0<br>
  Accept: <em>/</em><br>
  Accept-Language: en-US,en;q=0.5<br>
  Accept-Encoding: gzip, deflate<br>
  Authorization: Basic   YmJvbm5ldDE4Om9jdG9iZXIxNw==<br>
  X-Requested-With: XMLHttpRequest<br>
  Referer: mysite<br>
  Connection: keep-alive  </p>
  
  <p>Here are the relevant pieces of my config (I can post more if necessary):</p>
  
  <pre><code>&lt;modules&gt;
    &lt;add name="BasicAuthHttpModule" type="ITMService.Modules.BasicAuthHttpModule"/&gt;
  &lt;/modules&gt;
  
  &lt;httpModules&gt;
    &lt;add name="BasicAuthHttpModule" type="ITMService.Modules.BasicAuthHttpModule"/&gt;
  &lt;/httpModules&gt;
  
  &lt;authentication mode="Windows"/&gt;
  </code></pre>
  
  <p>My custom http module (also working fine in testing from visual studio). This was mostly taken from the <a href="http://www.asp.net/web-api/overview/security/basic-authentication" rel="nofollow">example on asp.net</a> :</p>
  
  <pre><code>namespace ITMService.Modules
  {
  public class BasicAuthHttpModule : IHttpModule
  {
  
      private const string Realm = "www.mysite.net";
  
      public void Init(HttpApplication context)
      {
          context.AuthenticateRequest += OnApplicationAuthenticateRequest;
          context.EndRequest += OnApplicationEndRequest;
  
      }
  
      private static void SetPrincipal(IPrincipal principal)
      {
          Thread.CurrentPrincipal = principal;
          if (HttpContext.Current != null)
          {
              HttpContext.Current.User = principal;
              Log.LogIt("current principal: " + principal.Identity.Name);
          }
      }
  
  
      private static bool CheckPassword(string username, string password)
      {
          string passHash = AuthUser.GetUserPassword(username);
          if (PasswordHash.ValidatePassword(password, passHash))
          {
              return true;
          }
          else
          {
              return false;
          }
  
      }
  
      private static bool AuthenticateUser(string credentials)
      {
          bool validated = false;
  
          try
          {
              var encoding = Encoding.GetEncoding("iso-8859-1");
              credentials = encoding.GetString(Convert.FromBase64String(credentials));
  
              int separator = credentials.IndexOf(':');
              string name = credentials.Substring(0, separator);
              string password = credentials.Substring(separator + 1);
  
              validated = CheckPassword(name, password);
  
              if (validated)
              {
                  var identity = new GenericIdentity(name);
                  SetPrincipal(new GenericPrincipal(identity, null));
              }
          }
          catch (FormatException)
          {
              // Credentials were not formatted correctly.
              validated = false;
              Log.LogIt("not validated");
  
          }
          return validated;
      }
  
      private static void OnApplicationAuthenticateRequest(object sender, EventArgs e)
      {
  
          var request = HttpContext.Current.Request;
          var authHeader = request.Headers["Authorization"];
          if (authHeader != null)
          {
  
              var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);
  
              // RFC 2617 sec 1.2, "scheme" name is case-insensitive
              if (authHeaderVal.Scheme.Equals("basic",
                      StringComparison.OrdinalIgnoreCase) &amp;&amp;
                  authHeaderVal.Parameter != null)
              {
  
                  AuthenticateUser(authHeaderVal.Parameter);
              }
          }
      }
  
      // If the request was unauthorized, add the WWW-Authenticate header 
      // to the response.
      private static void OnApplicationEndRequest(object sender, EventArgs e)
      {
  
          var response = HttpContext.Current.Response;
          if (response.StatusCode == 401)
          {
              response.Headers.Add("WWW-Authenticate",
                  string.Format("Basic realm=\"{0}\"", Realm));
          }
      }
  
      public void Dispose()
      {
      }
  }
  }
  </code></pre>
  
  <p>My IIS server is hosted and running .NET 4 in integrated pipeline mode. I disabled forms authentication and disabled impersonation. I enabled basic authentication and anonymous authentication methods on the server. </p>
  
  <p>I've read countless forum responses and posts about this and nothing has lead me to a clear answer.</p>