Send BASIC auth by default, not wait for HTTP 401

Question

I have a web service that requires a BASIC authentication header in the request, or the service will return HTTP 401 (unauthorized). This works - when the call returns, the browser (in this case, Chrome) appears and asks for credentials. They are then saved for future requests.

My problem is that now two requests are executed for each subsequent service request - without auth (which receives 401), and then the browser immediately responds with the correct authentication in the header.

Is there a way to get the browser (perhaps through a special header) to provide credentials without requiring an explicit web service request each time?

Answer 1

I do not believe that you can force the browser to preempt 401. When the request for your service is executed, the service responds with HTTP 401 and adds the WWW-Authenticate Basic header, as well as, I assume, an area (which you can define).

It would be helpful to take a look at the RFC for basic authentication, which details how basic authentication standards should be applied. http://www.ietf.org/rfc/rfc2617.txt

You can also explore your own HTTP module, which should provide you with more flexibility in your application and how you deal with basic authentication. This allows you to register event handlers for authentication and request completion events and dictate with greater clarity how your service will work with basic auth. A primer for this is available on the asp.net website. http://www.asp.net/web-api/overview/security/basic-authentication

If your services use different authentication based on the verification of your applications (for example, the service will only use basic authentication when the application is configured to authenticate forms), than using the HTTP module will allow you to conditionally use basic authentication. I usually register handlers in this scenario as follows:

AuthenticationSection config = (AuthenticationSection)WebConfigurationManager.GetSection("system.web/authentication"); if(config.Mode == AuthenticationMode.Forms) { module.Authenticate += OnEnter; context.EndRequest += OnLeave; }