title: How do I use WebClient to make Basic Authentication calls to IIS WebAPI?
body: <p>Using a <code>PowerShell Cmdlet</code> encapsulating a <code>WebClient</code> call to a <code>WebAPI</code>, I am attempting to implement Basic Authentication.  I have tried a couple methods and settled on adding a Filter to the <code>WebAPI</code> as suggested here <a href="http://weblog.west-wind.com/posts/2013/Apr/18/A-WebAPI-Basic-Authentication-Authorization-Filter#Resources" rel="nofollow" title="Authorization Filters">WebAPI Authentication Filter</a>.</p>
  
  <p>FYI: Since this is to be a file-upload tool I would prefer the data only be sent once, as the files will be up to 10MB text logs, hence I am creating the header for the first contact.</p>
  
  <p>From the <code>PowerShell Cmdlet</code>:</p>
  
  <pre><code>private async Task&lt;string&gt; Run(string postBody, string Username, string Password)
  {
      using (var client = new WebClient())
      {
          client.Headers[HttpRequestHeader.ContentType] = Common.DefaultMediaType;
  
          var credentials = Convert.ToBase64String(Encoding.ASCII.GetBytes(Username + ":" + Password));
          client.Headers[HttpRequestHeader.Authorization] = $"Basic {credentials}";
  
          string response;
          try
          {
              response = await client.UploadStringTaskAsync($"{_baseAddress}/{_uriTestConPost}", postBody);
          }
          catch (WebException ex)
          {
              var webResponse = ex.Response as HttpWebResponse;
              if (webResponse == null) throw ex;
  
              WriteWarning("WebException: " + webResponse.StatusCode);
              return null;
          }
          return response;
      }
  }
  </code></pre>
  
  <p>Running this code as is produced a 401, and no echoes in the debugger.</p>
  
  <p>Running this code with the credentials and header commented out creates two messages from Fiddler, one without authorization and another with authorization.  Both get denied with 401 <strong>but</strong> the debugger on the <code>WebAPI Controller</code> shows that I am only attempting to authorize the first time, the second attempt is formed correctly with the encoded authorization header but is rejected with code 401 without ever hitting the debugger.</p>
  
  <p>The <code>ApiController</code> is as simple as I could make it to verify:</p>
  
  <pre><code>public class TestReportController : ApiController
  {
      [HttpPost]
      [McpBasicAuthenticationFilter]
      public async Task&lt;string&gt; TestConnectionPost()
      {
          dynamic message = await Request.Content.ReadAsStringAsync();
  
          return "You sent " + message.ToString();
      }
  }
  </code></pre>
  
  <p>At this point, I have to think the authorization problem is my <code>web.Config</code> or my IIS setup.  For IIS I have Anonymous and Basic Authorization enabled (other parts of the site need anonymous access).</p>
  
  <p>Important area of the WebConfig from what I can tell:</p>
  
  <pre><code>&lt;system.web&gt;
       &lt;authentication mode="None" /&gt;
       &lt;compilation debug="true" targetFramework="4.5.1" /&gt;
       &lt;httpRuntime targetFramework="4.5.1" executionTimeout="240000" maxRequestLength="1073741824" /&gt;
       &lt;identity impersonate="false" /&gt;
   &lt;/system.web&gt;
  </code></pre>
  
  <p><strong>What is blocking the requests that have the credentials?</strong></p>