ASP.Net site using Windows Authentication pops up "Authentication Required Window" a lot in Firefox

Question

I have an ASP.Net application where I am using Windows authentication to deny access to some components via roles. When using IE, the site pops up the "Authentication Required" box once, allows the user to enter their username/password for Active Directory, and all is fine.

HOWEVER, when using Firefox, it's "Authentication Required" box pops up, but when you click 'ok', it comes up again! It stays up a few dozen times! If you click cancel to all of them, it fails properly, denying access to the site. If you click cancel to all but 1 (Which you authenticate properly), it acts like you were properly authenticated.

My goal here is to have Firefox act like IE, and only ask the user once.

Answer 1

you could get Firefox to behave exacylt like IE by adding the site to about:config >> network.automatic-ntlm-auth.trusted-uris then firefox will use Windows Auth for the site

Answer 2

Maybe it would be best to redesign your login/authentication system such that authentication is asked only when the user first views/logs-in to the website (i.e. a login.aspx page) so that after that the users's credentials are cached throughout your website.

Answer 3

This forum post recommends updating your web.config to allow anon on WebResource.axd: http://forums.asp.net/p/1295804/2515478.aspx#2515478

Not ideal - I don't really understand WHY axd requests are behaving like this.

NOTE: NTLM requires keep-alive, if you install fiddler or firebug you should be able to see the "Connection: keep-alive" messages in the request header: http://davenport.sourceforge.net/ntlm.html#ntlmHttpAuthentication