title: How does the System.Net.Http.HttpClient select authentication type?
body: <p>Let's say I new up the <code>HttpClient</code> and send off a request to a protected endpoint like this:</p>
  
  <pre><code>var httpClient = new HttpClient();
  var request = new HttpRequestMessage(HttpMethod.Get, "url");
  var response = await httpClient.SendAsync(request);
  </code></pre>
  
  <p>I then get a response with the following headers:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Content-Type: text/html
  WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM
  WWW-Authenticate: Basic
  Date ...
  </code></pre>
  
  <p>From the response headers, I see that I have three different options to authenticate with the server (Negotiate, NTLM, Basic). I then update my code to this:</p>
  
  <pre><code>var httpClientHandler = new HttpClientHandler
  {
      Credentials = new NetworkCredential
      {
          UserName = "username",
          Password = "password"
      }
  };
  var httpClient = new HttpClient(httpClientHandler);
  var request = new HttpRequestMessage(HttpMethod.Get, "url");
  var response = await httpClient.SendAsync(request);
  </code></pre>
  
  <p>I execute my program again, and this time I get a 200 OK in return. All fine.</p>
  
  <p>If I inspect the request with fiddler, I see that the <code>HttpClient</code> decided to use "Negotiate" as the authentication method.</p>
  
  <p><strong>Now, my question is:</strong> how does the <code>HttpClient</code> decide which authentication type to apply? Does it have a precedence for some authentication types over others?</p>
  
  <p>The docs on <a href="https://docs.microsoft.com/en-us/dotnet/api/system.net.networkcredential?view=netframework-4.8" rel="nofollow noreferrer"><code>NetworkCredential</code></a> states that:</p>
  
  <blockquote>
    <p>The NetworkCredential class is a base class that supplies credentials
    in password-based authentication schemes such as basic, digest, NTLM,
    and Kerberos.</p>
  </blockquote>
  
  <p>... so I know the credentials I provide could have been applied for all three authentication types, but I have not been able to figure out how / why it selects a specific authentication type over another.</p>
  
  <p>Any insight into this is greatly appreciated, thanks in advance!</p>