aspnetcore: Multiple 401 when using Windows authentication on HTTP.sys

Describe the bug

The 401 WWW-Negotiate challenge happens for each request.

To Reproduce

Steps to reproduce the behavior:

  1. Using this version of ASP.NET Core ‘2.2’
  2. Set up HTTP.Sys with options.Authentication.Schemes = Microsoft.AspNetCore.Server.HttpSys.AuthenticationSchemes.Negotiate;
  3. Run Fiddler to intercept requests
  4. Use a client to perform a GET

Expected behavior

The 401 WWW-Negotiate challenge happens only the first time.

Additional context

It looks like when using IIS it is possible to configure authPersistNonNTLM=true to achieve this. See [https://blogs.msdn.microsoft.com/dsnotes/2014/02/11/iis-how-to-reduce-multiple-authentication-or-multiple-401-while-using-kerberos-for-authentication/](this link)

Side note

Performing the 401 challenge means more requests, more traffic, less performance.

About this issue

  • Original URL
  • State: open
  • Created 5 years ago
  • Comments: 15 (9 by maintainers)

Commits related to this issue

Most upvoted comments

No, UseDefaultCredentials means to use the current WindowsIdentity if challenged for 401 Negotiate/NTLM/Kerberos. It means you don’t have to give it the username and password manually.