title: 401 error after successful login using browser
body: <p>Using my browser I point to a URL and I am prompted with a username/password dialog. I enter my username/password and I get my webpage.</p>
  <p>I get a 401 error, however, when using curl:</p>
  <pre><code>curl --anyauth --user &quot;$USERNAME:$PASSWORD&quot; $URL
  </code></pre>
  <p>wget:</p>
  <pre><code>wget --http-user=$USERNAME --http-password=$PASSWORD $URL
  </code></pre>
  <p>Python:</p>
  <pre><code>response = requests.get(url, auth=requests.auth.HTTPBasicAuth(username, password))
  response = requests.get(url, auth=requests.auth.HTTPDigestAuth(username, password))
  </code></pre>
  <p>The verbose (sanitized) output is below for curl:</p>
  <pre><code>* About to connect() to application.intranet.net port 443 (#0)
  *   Trying 10.10.10.139...
  * Connected to application.intranet.net (10.10.10.139) port 443 (#0)
  * Initializing NSS with certpath: sql:/etc/pki/nssdb
  *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
    CApath: none
  * SSL connection using TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
  * Server certificate:
  *       subject: CN=application.intranet.net,OU=COMPANY - Web Hosting,O=Com Pany Inc.,STREET=address,L=city,ST=state,postalCode=12345,C=US
  *       start date: Apr 06 00:00:00 2020 GMT
  *       expire date: Apr 06 23:59:59 2022 GMT
  *       common name: application.intranet.net
  *       issuer: CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
  &gt; GET /appname/Reporting/ReportListStart.aspx HTTP/1.1
  &gt; User-Agent: curl/7.29.0
  &gt; Host: application.intranet.net
  &gt; Accept: */*
  &gt; 
  &lt; HTTP/1.1 401 Unauthorized
  &lt; Cache-Control: private
  &lt; Content-Type: text/html
  &lt; Server: application Server
  &lt; WWW-Authenticate: Negotiate
  &lt; WWW-Authenticate: NTLM
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; X-Content-Type-Options: nosniff
  &lt; Date: Wed, 23 Dec 2020 16:17:22 GMT
  &lt; Content-Length: 1293
  &lt; 
  * Ignoring the response-body
  * Connection #0 to host application.intranet.net left intact
  * Issue another request to this URL: 'https://application.intranet.net/appname/Reporting/ReportListStart.aspx'
  * Found bundle for host application.intranet.net: 0x1f4b050
  * Re-using existing connection! (#0) with host application.intranet.net
  * Connected to application.intranet.net (10.10.10.139) port 443 (#0)
  &gt; GET /appname/Reporting/ReportListStart.aspx HTTP/1.1
  &gt; User-Agent: curl/7.29.0
  &gt; Host: application.intranet.net
  &gt; Accept: */*
  &gt; 
  &lt; HTTP/1.1 401 Unauthorized
  &lt; Cache-Control: private
  &lt; Content-Type: text/html
  &lt; Server: application Server
  * gss_init_sec_context() failed: : No Kerberos credentials available (default cache: KEYRING:persistent:9013)
  &lt; WWW-Authenticate: Negotiate
  &lt; WWW-Authenticate: NTLM
  &lt; X-Frame-Options: SAMEORIGIN
  &lt; X-Content-Type-Options: nosniff
  &lt; Date: Wed, 23 Dec 2020 16:17:22 GMT
  &lt; Content-Length: 1293
  &lt; 
  &lt;!DOCTYPE html PUBLIC &quot;-//W3C//DTD XHTML 1.0 Strict//EN&quot; &quot;http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd&quot;&gt;
  &lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;&gt;
  &lt;head&gt;
  &lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=iso-8859-1&quot;/&gt;
  &lt;title&gt;401 - Unauthorized: Access is denied due to invalid credentials.&lt;/title&gt;
  &lt;style type=&quot;text/css&quot;&gt;
  &lt;!--
  body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
  fieldset{padding:0 15px 10px 15px;} 
  h1{font-size:2.4em;margin:0;color:#FFF;}
  h2{font-size:1.7em;margin:0;color:#CC0000;} 
  h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} 
  #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:&quot;trebuchet MS&quot;, Verdana, sans-serif;color:#FFF;
  background-color:#555555;}
  #content{margin:0 0 0 2%;position:relative;}
  .content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
  --&gt;
  &lt;/style&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;div id=&quot;header&quot;&gt;&lt;h1&gt;Server Error&lt;/h1&gt;&lt;/div&gt;
  &lt;div id=&quot;content&quot;&gt;
   &lt;div class=&quot;content-container&quot;&gt;&lt;fieldset&gt;
    &lt;h2&gt;401 - Unauthorized: Access is denied due to invalid credentials.&lt;/h2&gt;
    &lt;h3&gt;You do not have permission to view this directory or page using the credentials that you supplied.&lt;/h3&gt;
   &lt;/fieldset&gt;&lt;/div&gt;
  &lt;/div&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  * Connection #0 to host application.intranet.net left intact
  </code></pre>
  <p>wget:</p>
  <pre><code>--2020-12-23 11:18:14--  https://application.intranet.net/appname/Reporting/ReportListStart.aspx
  Resolving application.intranet.net (application.intranet.net)... 10.10.10.139, 10.10.10.10
  Connecting to application.intranet.net (application.intranet.net)|10.10.10.139|:443... connected.
  HTTP request sent, awaiting response... 401 Unauthorized
  Reusing existing connection to application.intranet.net:443.
  HTTP request sent, awaiting response... 401 Unauthorized
  Reusing existing connection to application.intranet.net:443.
  HTTP request sent, awaiting response... 401 Unauthorized
  Authorization failed.
  </code></pre>
  <p>Python:</p>
  <pre><code>DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): application.intranet.net:443
  send: b'GET /appname/Reporting/ReportListStart.aspx HTTP/1.1\r\nHost: application.intranet.net\r\nUser-Agent: python-requests/2.25.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nConnection: keep-alive\r\nAuthorization: Basic U19KaXJhX0ludGVybmFsQXVkaXQ6R2l4X0lLdzFqTEYtMld0cw==\r\n\r\n'
  reply: 'HTTP/1.1 401 Unauthorized\r\n'
  header: Cache-Control: private
  header: Content-Type: text/html
  header: Server: application Server
  header: WWW-Authenticate: Negotiate
  header: WWW-Authenticate: NTLM
  header: X-Frame-Options: SAMEORIGIN
  header: X-Content-Type-Options: nosniff
  header: Date: Wed, 23 Dec 2020 17:01:10 GMT
  header: Content-Length: 1293
  DEBUG:urllib3.connectionpool:https://application.intranet.net:443 &quot;GET /appname/Reporting/ReportListStart.aspx HTTP/1.1&quot; 401 1293
  DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): application.intranet.net:443
  send: b'GET /appname/Reporting/ReportListStart.aspx HTTP/1.1\r\nHost: application.intranet.net\r\nUser-Agent: python-requests/2.25.0\r\nAccept-Encoding: gzip, deflate\r\nAccept: */*\r\nConnection: keep-alive\r\n\r\n'
  reply: 'HTTP/1.1 401 Unauthorized\r\n'
  header: Cache-Control: private
  header: Content-Type: text/html
  header: Server: application Server
  header: WWW-Authenticate: Negotiate
  header: WWW-Authenticate: NTLM
  header: X-Frame-Options: SAMEORIGIN
  header: X-Content-Type-Options: nosniff
  header: Date: Wed, 23 Dec 2020 17:01:10 GMT
  header: Content-Length: 1293
  DEBUG:urllib3.connectionpool:https://application.intranet.net:443 &quot;GET /appname/Reporting/ReportListStart.aspx HTTP/1.1&quot; 401 1293
  </code></pre>
  <p>From my browser there is the initial request that returns a 302:</p>
  <pre><code>Request URL: https://application.wuintranet.net/appname/Reporting/ReportListStart.aspx
  Request Method: GET
  Status Code: 302 Found
  Remote Address: 10.10.10.123:443
  Referrer Policy: strict-origin-when-cross-origin
  Cache-Control: private
  Content-Length: 160
  Content-Type: text/html; charset=utf-8
  Date: Wed, 23 Dec 2020 17:14:54 GMT
  Location: /appname/Reporting/ReportListStart.aspx
  Persistent-Auth: true
  Server: application Server
  Set-Cookie: ASP.NET_SessionId=dy2rr35onasw5ctumhuqb4af; path=/; secure; HttpOnly; SameSite=Lax
  Set-Cookie: appname_Cookie=ConnectionTitle=DELwLGx+KbrtS0gKvmretg==&amp;IsConnectionTitleSet=True&amp;IsLogOff=False&amp;CurrentOrganization=ELx658BVmiesDFQg7w5RtA==&amp;IsOrganizationRequired=YBfC/taoB3Ll19UPqF9IEA==; path=/; secure; HttpOnly
  Set-Cookie: .application_SSO_Cookie=ConnectionTitle=DELwLGx+KbrtS0gKvmretg==&amp;IsConnectionTitleSet=True&amp;IsLogOff=True&amp;CurrentOrganization=ELx658BVmiesDFQg7w5RtA==&amp;IsOrganizationRequired=YBfC/taoB3Ll19UPqF9IEA==; path=/; secure; HttpOnly
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.9
  Cache-Control: max-age=0
  Connection: keep-alive
  Host: application.wuintranet.net
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: none
  Sec-Fetch-User: ?1
  Upgrade-Insecure-Requests: 1
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
  </code></pre>
  <p>and then the browser-generated followup that returns 200:</p>
  <pre><code>Request URL: https://application.wuintranet.net/appname/Reporting/ReportListStart.aspx
  Request Method: GET
  Status Code: 200 OK
  Remote Address: 10.10.10.123:443
  Referrer Policy: strict-origin-when-cross-origin
  Cache-Control: private
  Content-Encoding: gzip
  Content-Length: 32914
  Content-Type: text/html; charset=utf-8
  Date: Wed, 23 Dec 2020 17:14:54 GMT
  Persistent-Auth: true
  Server: application Server
  Set-Cookie: appname_Cookie=ConnectionTitle=DELwLGx+KbrtS0gKvmretg==&amp;IsConnectionTitleSet=True&amp;IsLogOff=False&amp;CurrentOrganization=ELx658BVmiesDFQg7w5RtA==&amp;IsOrganizationRequired=YBfC/taoB3Ll19UPqF9IEA==; path=/; secure; HttpOnly
  Vary: Accept-Encoding
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Accept-Encoding: gzip, deflate, br
  Accept-Language: en-US,en;q=0.9
  Cache-Control: max-age=0
  Connection: keep-alive
  Cookie: ASP.NET_SessionId=dy2rr35onasw5ctumhuqb4af; appname_Cookie=ConnectionTitle=DELwLGx+KbrtS0gKvmretg==&amp;IsConnectionTitleSet=True&amp;IsLogOff=False&amp;CurrentOrganization=ELx658BVmiesDFQg7w5RtA==&amp;IsOrganizationRequired=YBfC/taoB3Ll19UPqF9IEA==; .application_SSO_Cookie=ConnectionTitle=DELwLGx+KbrtS0gKvmretg==&amp;IsConnectionTitleSet=True&amp;IsLogOff=True&amp;CurrentOrganization=ELx658BVmiesDFQg7w5RtA==&amp;IsOrganizationRequired=YBfC/taoB3Ll19UPqF9IEA==
  Host: application.wuintranet.net
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: none
  Sec-Fetch-User: ?1
  Upgrade-Insecure-Requests: 1
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
  </code></pre>