HttpWebRequest not passing Credentials

Question

I'm trying to use HTTPWebRequest to access a REST service, and am having problems passing credentials in, see code below. I've read that NetworkCredential doesn't support SSL, and I'm hitting an https site. Does anyone know of a class similar to NetworkCredential that does support SSL?

    Uri requestUri = null;
    Uri.TryCreate("https://mywebserver/webpage"), 
        UriKind.Absolute, out requestUri);

    HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create
        (requestUri);

    NetworkCredential nc =
        new NetworkCredential("user", "password");

    request.Credentials = nc;

    request.Method = WebRequestMethods.Http.Get;
    HttpWebResponse response = (HttpWebResponse)request.GetResponse();

Answer 1

If your server uses NTLM authentication you may try this:

CredentialCache cc = new CredentialCache();
cc.Add(
    new Uri("https://mywebserver/webpage"), 
    "NTLM", 
    new NetworkCredential("user", "password"));
request.Credentials = cc;

Answer 2

Try setting request.PreAuthenticate to true.

Answer 3

What kind of authentication mechanism is protecting the web service? The credentials set on HttpWebRequest will only be passed through HTTP's Authorization header via Basic, Digest or NTLM. So, if your web service is protected with WS-Security, the NetworkCredentials will probably not be passed on to the authentication scheme at all, because WS-Security doesn't operate at the HTTP level.

What you should do is create a Web Service client proxy for the web service through the command line tool wsdl.exe or something similar. That will give you access to Web Service aware authentication schemes.

Update after comments:

It seems like HttpWebRequest needs to receive the WWW-Authenticate challenge with a 401 Unauthorized before it can authenticate properly over SSL. I guess there's two separate code paths in HttpWebRequests handling regular HTTP traffic and encrypted HTTPS traffic. Anyway, what you should try, is:

1. Execute an unauthenticated HttpWebRequest to the https://.../ URI.
2. Receive the 401 Unauthorized response.
3. Execute the same request, now with both Credentials set (not sure if PreAuthenticate should be true or false; test both).
4. You should now get 200 OK or whatever it is your Web Service responds with.

Another option is to build the Authorization header yourself on the initial request:

string credentials = String.Format("{0}:{1}", username, password);
byte[] bytes = Encoding.ASCII.GetBytes(credentials);
string base64 = Convert.ToBase64String(bytes);
string authorization = String.Concat("basic ", base64);
request.Headers.Add("Authorization", authorization);

Answer 4

See if it shows up when you use the old-fashioned method:

string credentials = Convert.ToBase64String(ASCIIEncoding.ASCII.GetBytes("user"+ ":" + "password"));
request.Headers.Add("Authorization", "Basic " + credentials);

Answer 5

Try and create a tracelog for your application. See http://ferozedaud.blogspot.com/2009/08/tracing-with-systemnet.html

The credentials wont be sent unless the server asks for it. The server asks for it by replying to your request with a 401 status code, and sending a WWW-Authenticate header that contains the authentication schemes supported.

Also, you may be able to force the app to send credentials in the first request itself, by setting PreAuthenticate=true.