title: Self-hosted WCF REST service and Basic authentication
body: <p>I've created a self-hosted WCF REST service (with some extra's from WCF REST Starter Kit Preview 2). This is all working fine.</p>
  
  <p>I'm now trying to add Basic authentication to the service. But I'm hitting some rather large roadblocks in the WCF stack which is preventing me from doing this.</p>
  
  <p>It appears that the <code>HttpListener</code> (which self-hosted WCF services use internally at a low level in the WCF stack) is blocking my attempts to insert a <code>WWW-Authenticate</code> header on a self-generated <code>401 Unauthorized</code> response. Why?</p>
  
  <p>I can get the authentication working if I forget about this <code>WWW-Authenticate</code> header (which it seems Microsoft did as well). But that's the issue. If I don't send back a <code>WWW-Authenticate</code> header then the web browser won't display its standard "logon" dialog. The user will merely be faced with a <code>401 Unauthorized</code> error page with no way to actually log on.</p>
  
  <p>REST services should be accessible to both computers and humans (well at least on the GET request level). Therefore, I feel that WCF REST is not complying with a fundamental part of REST here. Does anyone agree with me?</p>
  
  <p>Has anyone got Basic authentication working with a self-hosted WCF REST service? If so, how did you do it?</p>
  
  <p>PS: Obviously my intentions to use unsecure Basic authentication are on the premise that I'd also get HTTPS/SSL working for my service too. But that's another matter.</p>
  
  <p>PPS: I've tried WCF REST Contrib (<a href="http://wcfrestcontrib.codeplex.com/" rel="nofollow noreferrer">http://wcfrestcontrib.codeplex.com/</a>) and that has exactly the same issue. It appears this library has not been tested in self-hosted scenarios.</p>
  
  <p>Thanks.</p>