Re: Authorization HTML Header going missing

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Shaun Wilde (shaun_wilde_at_nospam.co.uk)
Date: 11/30/04 

Date: Tue, 30 Nov 2004 22:04:11 -0000

Hi Steven

I'll give it a try

I've come across the following

http://groups.google.co.uk/groups?q=Authorization+header&hl=en&lr=&group=microsoft.public.dotnet.framework.aspnet.*&selm=u4pdtNCqCHA.2360%40TK2MSFTNGP09&rnum=1

and it seems to descibe the same symptoms. It also seems to be that it (the
Authorization header) will come through if we enable basic authentication.

Okay but whey the difference between 2000 and 2003.

Actually the problem occurs only if the server is 2000, the client is not a
factor.

Basic Authentication isn't turned on via IIS and there should be no need to
do so as I wish to use a HttpHandler to look after the credentials and send
back an Authorization error (403?) - this is because the application could
be hosted on a site where access to the IIS is minimal (3rd party hosting
environment).

Also I wish to authenticate against my own control list (database or
web.config) and not that controlled by a 3rd party.

Shaun

"Steven Cheng[MSFT]" <v-schang@online.microsoft.com> wrote in message
news:D5SQYbe1EHA.768@cpmsftngxa10.phx.gbl...
> Hi Shaun,
>
> Yes, the problem is so strange. I'm sure this is a enviromential specific
> issue. Also, you've mentioned that the problem only occur when your client
> app and the webservice are on the same machine,(locally), so I've exclude
> the possibility of some firewall or proxy that may intercept the
> authorization header.
> In addition, I'm not sure whether you've tried sending a custom http
header
> as I mentioned in my last reply to see whether this can work?
>
> Also, I've attached a ISAPI filter made by our IIS support guy which can
> help capture the raw data send to IIS.
> You may also try install it and capture the HTTP headers (when calling the
> webservice) on the problem machine to see whether the header has arrived
> the IIS. Here is the install steps for the isapi filter
>
> ==============
> Please open the server(computer icon)'s property->WWW Service global
> setting->ISAPI Filter tab, add the dll as a new ISAPI
filter(WriteRawData).
>
> Then please restart IIS service via iisreset command. Reproduce the
> problem. The filter will capture the incoming and outgoing rawdata in 2
> files at c: - InRawData.log, OutRawData.log
>
> =============
>
> Hope helps. Thanks.
>
> Regards,
>
> Steven Cheng
> Microsoft Online Support
>
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>

Relevant Pages

  • Re: Accessing Authenticate Header
    ... IIS configuration for anonymous access ONLY (NO Basic Authentication) ... Handler or Module reads the AUTHORIZATION header and authenticates ...
    (microsoft.public.dotnet.security)
  • experiment supports concept of using host header names as securit y layer
    ... ISAPI filters can't evaluate a request until a virtual site has been ... selected and its set of running ISAPI filters has become known to the IIS ... As a quick experiment in using a host header name as a security device, ...
    (Focus-Microsoft)
  • Re: How can I set "remote_user" in ISAPI filter/Extension?
    ... No. Server Variables are read-only entities representative of the ... would IIS want to parse the Authorization header for anonymous auth? ... Clients make Anonymous request ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS (or Isapi) adds Connection header to response
    ... I would never rely on a bug in a browser implementation as the means to get ... > I dont currently have access to the ISAPI code. ... available on any other IIS version. ... NTLM header since it is no longer useful. ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS authentication (kerberos and Integrated security)
    ... Most challenge/response authentication protocols rely on a challenge being issues, and the client using that to develop a response which is sent back to the server. ... the client is *not* sending the correct authorization data to the server for the second request. ... WWW-Authenticate header? ...
    (microsoft.public.inetserver.iis.security)