title: How to get ServiceStack authentication to work? (with iPhone clients)
body: <p>We have hired a contractor who is writing an iPhone app for us, and I'm starting to write the backend service for it with ServiceStack.</p>
  
  <p>I'm struggling with authorization in general: what kind of authorization to use and how to implement it.<br>
  I don't know much about ServiceStack, HTTP and authorization (yet).. I've read <a href="https://github.com/ServiceStack/ServiceStack/wiki/Authentication-and-authorization">this</a>, but I'm probably still doing something wrong.</p>
  
  <p>I will use usernames and passwords from an existing legacy database to authenticate (but nothing else - no registering of new users, no different permissions. Just authenticating).<br>
  So I need to write my own provider.  </p>
  
  <p>I've managed to implement a working <code>CredentialsAuthProvider</code> with the help from <a href="http://enehana.nohea.com/general/customizing-iauthprovider-for-servicestack-net-step-by-step/">this tutorial</a>.<br>
  It works when I test it in the browser:</p>
  
  <ul>
  <li>call my service and get a 401</li>
  <li>POST to <code>auth/credentials</code></li>
  <li>call my service again and get the correct result</li>
  </ul>
  
  <p>However, I noticed that the same workflow doesn't work when I try it in Fiddler.</p>
  
  <p>The POST to <code>auth/credentials</code> works. I POST this:</p>
  
  <pre><code>POST http://localhost:52690/auth/credentials?format=json HTTP/1.1
  User-Agent: Fiddler
  Host: localhost:52690
  Content-Length: 74
  Content-Type: application/json; charset=utf-8
  
  {
    "UserName": "chspe",
    "Password": "xyz",
    "RememberMe": true
  }
  </code></pre>
  
  <p>...and get this:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: ASP.NET Development Server/10.0.0.0
  Date: Fri, 14 Jun 2013 13:07:35 GMT
  X-AspNet-Version: 4.0.30319
  X-Powered-By: ServiceStack/3,949 Win32NT/.NET
  Set-Cookie: ss-id=3YUUgfwIeJd7PedFK5Th; path=/; HttpOnly
  Set-Cookie: ss-pid=zQJ5Z4Vq7AY+BpVwbttj; expires=Tue, 14-Jun-2033 13:07:35 GMT; path=/; HttpOnly
  Set-Cookie: ss-opt=perm; expires=Tue, 14-Jun-2033 13:07:35 GMT; path=/; HttpOnly
  Set-Cookie: X-UAId=; expires=Tue, 14-Jun-2033 13:07:35 GMT; path=/; HttpOnly
  Cache-Control: private
  Content-Type: application/json; charset=utf-8
  Content-Length: 75
  Connection: Close
  
  {"sessionId":"zQJ5Z4Vq7AY+BpVwbttj","userName":"chspe","responseStatus":{}}
  </code></pre>
  
  <p>Looks good to me.<br>
  But then the call to my actual service still returns a 401:</p>
  
  <pre><code>GET http://localhost:52690/hello/world?format=json HTTP/1.1
  User-Agent: Fiddler
  Host: localhost:52690
  Content-Length: 0
  Content-Type: application/json; charset=utf-8
  </code></pre>
  
  <p>Response:</p>
  
  <pre><code>HTTP/1.1 401 Unauthorized
  Server: ASP.NET Development Server/10.0.0.0
  Date: Fri, 14 Jun 2013 13:07:44 GMT
  X-AspNet-Version: 4.0.30319
  WWW-Authenticate: credentials realm="/auth/credentials"
  X-Powered-By: ServiceStack/3,949 Win32NT/.NET
  Cache-Control: private
  Content-Length: 0
  Connection: Close
  </code></pre>
  
  <p><em>(this is the <code>HelloService</code> from the <a href="http://nuget.org/packages/ServiceStack.Host.AspNet/">ServiceStack.Host.AspNet package</a>, I just added the <code>[Authorize]</code> attribute)</em></p>
  
  <p>The actual request is correct, because the very same call works when I remove the <code>[Authorize]</code> attribute.</p>
  
  <p>I noticed that the <code>CredentialsAuthProvider</code> seems to work with cookies (there are several <code>Set-Cookie: ...</code> lines in the first response).</p>
  
  <h2>First question: Is the CredentialsAuthProvider even the right choice for a client that's not a browser?</h2>
  
  <p><strong>Apparently Fiddler does not recognize the cookies, how do I know if an iPhone <em>(or any other mobile device)</em> would?</strong></p>
  
  <p>Next, I tried to use Basic Authentication instead.<br>
  Here is my <code>BasicAuthProvider</code>:</p>
  
  <pre><code>public class MyBasicAuthProvider : BasicAuthProvider
  {
      public override object Authenticate(IServiceBase authService, IAuthSession session, Auth request)
      {
          if (request.UserName == "MyUser")
          {
              return true;
          }
      }
  }
  </code></pre>
  
  <p>But I'm stumped - I don't even get this to work from the browser.</p>
  
  <p>When I load the URL of my service in the browser, a window pops up and asks for username and password.<br>
  I enter the correct username and press Enter, and the same window pops up again immediately. And again, and again...and so on, no matter how often I enter the (correct) data.</p>
  
  <p>However, I can see that ServiceStack actually uses my <code>MyBasicAuthProvider</code>, because when I set a breakpoint in Visual Studio, I see that it recognizes the username and returns <code>True</code>.</p>
  
  <h2>Second question: What am I doing wrong?</h2>
  
  <p><strong>Do I need to do something more to get working Basic Auth with my own database? Isn't overriding <code>Authenticate</code> enough?</strong></p>