title: .net web executable to .net web api 401 error using BASIC authentication
body: <p>I am not allowed to install fiddler at work so I am kind of flying blind.</p>
  
  <p>I am running the web api and the web executable on local host through two separate instances of visual studio</p>
  
  <p>I am fairly certain my Web API is working ok I type the URL manually into a web browser it asks me for user Id and password and then returns my JSON.  </p>
  
  <p>The web executable that calls the web api also works fine until I attempted to add BASIC authentication to the controller method now I am receiving a 401 error.</p>
  
  <p>here is my code from the executable.</p>
  
  <pre><code> Public Function get_vsmric_webApi(ByRef sErrorDescription As String) As Boolean
          Try
              Using proxy As New WebClient()
                  Dim myurl As String = ConfigurationManager.AppSettings("WEBAPI_URL") &amp; "vsmric"
                  Dim userName As String = "QBERT"
                  Dim passWord As String = "Qb3RT!"
                  Dim credentials As String = Convert.ToBase64String(Encoding.ASCII.GetBytes(userName + ":" + passWord))
                  proxy.Headers(HttpRequestHeader.Authorization) = "BASIC" + credentials
                  Dim json As String = proxy.DownloadString(myurl)
                  Dim rics As List(Of DB2VSMRIC) = JsonConvert.DeserializeObject(Of List(Of DB2VSMRIC))(json)
                  Dim list As List(Of DB2VSMRIC) = rics.Where(Function(p) HasData(p.Cage)).ToList
                  If list.Count &lt; 1 Then
                      sErrorDescription = "No VSMRIC w/Cage records found."
                  Else
  
                      dictShipFrom = New Dictionary(Of String, String)
                      dictShipFrom = list.ToDictionary(Function(p) p.Ric, Function(p) p.Dodaac)
  
                      dictCage = New Dictionary(Of String, String)
                      dictCage = list.ToDictionary(Function(p) p.Ric, Function(p) p.Cage)
                  End If
              End Using
          Catch ex As Exception
              sErrorDescription = "Exception in get_vsmric_webApi(), " &amp; ex.Message
  
              Return False
          Finally
  
          End Try
  
          Return True
      End Function
  </code></pre>
  
  <p>here is the controller method on the web api</p>
  
  <pre><code>[CustomAuthentication]
      [CustomAuthorization("qbert")]
      public class VSMRICController : ApiController
      {
          /// &lt;summary&gt;
          /// Returns all records in the DB2 VSM RIC table
          /// &lt;/summary&gt;
          /// &lt;param name="id"&gt;The ID of the data.&lt;/param&gt;
          public IEnumerable&lt;DB2VSMRIC&gt; Get()
          {
              return DB2VSMRICRepository.getAll();
          }
  </code></pre>
  
  <p>here is the filter (for authentication)</p>
  
  <pre><code>public class CustomAuthenticationAttribute : Attribute, IAuthenticationFilter
      {
          // the job of the AuthenticateAsync method is to examine the request to see whether it contains
          // the information that is required to identify a user. Information about the request is provided
          // through an instance of the HttpAuthenticationContext class.
          public Task AuthenticateAsync(HttpAuthenticationContext context, CancellationToken cancellationToken)
          {
              context.Principal = null;
              AuthenticationHeaderValue authentication = context.Request.Headers.Authorization;
              if (authentication != null &amp;&amp; authentication.Scheme == "Basic")
              {
                  string[] authData = Encoding.ASCII.GetString(Convert.FromBase64String(
                      authentication.Parameter)).Split(':');
                  context.Principal
                      = ApiManager.AuthenticateUser(authData[0], authData[1]);
              }
  
              if (context.Principal == null)
              {
                  context.ErrorResult 
                      = new UnauthorizedResult(new AuthenticationHeaderValue[]{
                          new AuthenticationHeaderValue("Basic")}, context.Request);
                      }
                      return Task.FromResult&lt;object&gt;(null);
              }
  
          public Task ChallengeAsync(HttpAuthenticationChallengeContext context, CancellationToken cancellationToken)
          {
              return Task.FromResult&lt;object&gt;(null);
          }
  
          public bool AllowMultiple
          {
              get { return false; }
          }
  
          }
  </code></pre>
  
  <p>Again I'm fairly confident the Web API is working fine as I can get to JSON by directly navigating to the url and providing credentials in any web browser. I'm thinking I am doing something wrong when I set up the header in the executable. any thoughts?  (I am running everything locally via 2 instance of visual studio)</p>