title: Why would my REST service .NET clients send every request without authentication headers and then retry it with authentication header?
body: <p>We happen to run a REST web service with API requiring that clients use <em>Basic</em> authentication. We crafted a set of neat samples in various languages showing how to interface with our service. Now I'm reviewing IIS logs of the service and see that the following pattern happens quite often:</p>
  
  <ul>
  <li>a request comes, gets rejected with HTTP code 401</li>
  <li>the same request is resent and succeeds</li>
  </ul>
  
  <p>which looks like the first request is sent without <em>Authorization</em> headers and then the second one is sent with the right headers and succeeds. Most of the time the log record contains "user-agent" which is the same string we planted into our .NET sample.</p>
  
  <p>So I assume the problem is with .NET programs only. The problem is not reproduced with our sample code so I assume the users somehow modified the code or wrote their own from scratch.</p>
  
  <p>We tried contacting the users but apparently they don't want to invest time into research. So it'd be nice to find what the most likely scenario is which leads to this behavior of .NET programs. </p>
  
  <p>Why would they do this? Why would they not attach the headers on the first attempt? </p>