title: Getting “Authentication failed. System.InvalidOperationException” error intermittently with jquery call to Webmethod
body: <p>I have a WebMethod in ASP.NET Webform, sitting in code behind of a foo.aspx page</p>
  
  <pre><code>    [WebMethod]
      public static String foo()
      {
         return "";
      }
  </code></pre>
  
  <p>I invoke it using jQuery</p>
  
  <pre><code>        $.ajax({
              type: "POST",
              url: '&lt;%= ResolveUrl("foo.aspx/foo")%&gt;',
              data: JSON.stringify(dataToServer),
              contentType: "application/json; charset=utf-8",
              success: function (data ) {
                   // work with data here
              }
          });
  </code></pre>
  
  <p>And this is the response header from the server</p>
  
  <pre><code>Request   
  Request Method:POST
  Status Code:401 Unauthorized
  2:2
  Cache-Control:private
  Content-Length:105
  Content-Type:application/json; charset=utf-8
  Date:Tue, 20 Jan 2015 04:40:36 GMT
  jsonerror:true
  Server:Microsoft-IIS/7.5
  X-Powered-By:ASP.NET
  </code></pre>
  
  <p>response body</p>
  
  <pre><code>{"Message":"Authentication failed.","StackTrace":null,"ExceptionType":"System.InvalidOperationException"}
  </code></pre>
  
  <p>Background information</p>
  
  <ul>
  <li>I do not use ASP.NET Friendly URL so please don't suggest me to turn
  AutoRedirectMode = Off.  </li>
  <li><p>I do use WebApi in my site, not sure if
  this's related. Here's my routing configuration</p>
  
  <pre><code>    RouteTable.Routes.MapHttpRoute(
          name: "DefaultApi",
          routeTemplate: "api/{controller}/{action}/{name}"
      );
  
  
      RouteTable.Routes.MapHttpRoute(
              name: "DefaultApiNoParameter",
              routeTemplate: "api/{controller}/{action}"
      );
  </code></pre></li>
  <li><p>The site that I build is hosted as a sub-application within another
  ASP.NET application.  So let's call my application bar, it's hosted within foobar, on a domain foo.com so <a href="http://foo.com/foobar/bar" rel="nofollow">http://foo.com/foobar/bar</a>. Sometimes, after a number of refreshes, the browser pop up "The site <a href="http://foo.com:80" rel="nofollow">http://foo.com:80</a> needs you to key in password blah blah..". All sites have Anonymous Authentication Enabled and Forms Authentication Enabled, other Authenticaion are Disabled.</p></li>
  <li><p>This is my web.config authentication setting, the idea is that the
  application is public, only foo.aspx is private and password
  protected.</p>
  
  <p>
        
      </p>
  
  <pre><code>&lt;authentication mode="Forms"&gt;
    &lt;forms name="cookie" loginUrl="login.aspx" defaultUrl="foo.aspx"&gt;
    &lt;credentials passwordFormat="SHA1"&gt;
      &lt;user name="foo"
            password="xxxxxxxx"/&gt;
      &lt;user name="bar"
            password="xxxxxxxxx"/&gt;
    &lt;/credentials&gt;
    &lt;/forms&gt;
  &lt;/authentication&gt;
  </code></pre>
  
  <p>
      
        
          
          
          
        
      
    </p></li>
  <li><p>The application works just fine in the testing environment with a
  single web server. Only when deployed to a web farm then this problem
  happens.</p></li>
  <li>The error happens intermittently, sometimes a request work, sometimes it doesn't. After a few times of refreshing the page, I will be automatically logged out. </li>
  </ul>