title: IE11 overrides Bearer authorization header in intranet environment
body: <p>I'm encountering a pretty strange issue in IE11 where the browser is overriding the Authorization header in my requests even though I am setting it via AngularJS.</p>
  
  <p>Basically, I have an HTTP interceptor registered for all requests that looks like this:</p>
  
  <pre><code>AuthInterceptorService.request = function (config) {
      config.headers.Authorization = "Bearer " + bearerToken;
  }
  </code></pre>
  
  <p>This works great in all browsers (even IE under certain conditions).  I have my app set up in IIS as allowing anonymous authentication and I have basic/integrated authentication disabled for this subsite, however, the parent configuration has windows authentication eabled.  </p>
  
  <p>What is happening occasionally is that the browser will make a request to the root URL for a static file (say, <code>/favicon.ico</code>).  This request is denied with a 401.  The browser responds with negotiated authentication and gets the favicon.  At this point, all other browsers still let my code set the Authorization header, but once this integrated authentication happens in IE, the authorization header seems to get stuck - no matter what my code does, the authorization header is always using integrated authentication.  This causes all requests to my API to fail because no Bearer token is present.</p>
  
  <p>I was able to work around the favicon issue by specifying a more local favicon (where static files can be served anonymously), but I am wondering if there is a less hacky solution to this issue.  Can I somehow convince IE to let me set the Authorization header even if Windows authentication has taken place on a previous request?</p>
  
  <p>Note: I found <a href="https://stackoverflow.com/questions/28615850/internet-explorer-11-replaces-authorization-header">this question</a> which seems to be related (maybe the same underlying cause).</p>