Passing NetworkCredential to HttpWebRequest in C# from ASP.Net Page

Question

I'm trying to use HTTPWebRequest to access a web service, and am having problems passing credentials in, see code below. I can see the credentials object, nc, being built in the debugger, and also in the assignment to request.Credentials, but when I get to the last line of code it faults with a not authorized error message. I've had our server folks watch the request on the server, and there are no credentials being passed. Am I doing something wrong with the Credentials object, or is there something I need to do that I'm not doing here?

Uri requestUri = null;
Uri.TryCreate("https://mywebserver/webpage"), 
    UriKind.Absolute, out requestUri);

HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create
    (requestUri);

NetworkCredential nc =
    new NetworkCredential("user", "password");

request.Credentials = nc;

request.Method = WebRequestMethods.Http.Get;
HttpWebResponse response = (HttpWebResponse)request.GetResponse(); 

Chaumont

Have you used Fiddler to see for yourself what you're passing? I dislike relying on server folks to evaluate things like this :) – Ferraro

JustLoren - I didn't know about Fiddler until you posted this comment, I downloaded it and under the Auth tab it says No Proxy-Authorization Header is present. No Authorization Header is present, so I'm still thinking there is something wrong with my code. – Chaumont

Is there a reason you're not generating a proxy class to call an internal web service? – Immediacy

Yes, the service I'm calling is a REST service so there is no wsdl file. – Chaumont

Answer 1

Microsoft Premier Support finally helped me solve this problem by using the CredentialCache class to add the Credentials and the "Basic" authorization:

NetworkCredential nc =
    new NetworkCredential(GetSetting("username"), GetSetting("password"));
CredentialCache cache = new CredentialCache();

cache.Add(requestUri, "Basic", nc);

HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create(requestUri);

Chaumont

not using ss l , will the password will be transferred in clear text ? – Aldos

Answer 2

The NetworkCredentials are either extremely non-intuitive, or flaky, or both. Regardless, you can solve the issue by bypassing NetworkCredentials altogether and use this method (which I found, courtesy of mark.michaelis.net)

/* http://mark.michaelis.net/Blog/CallingWebServicesUsingBasicAuthentication.aspx */
byte[] credentialBuffer = new UTF8Encoding().GetBytes(username + ":" +password);
req.Headers["Authorization"] ="Basic " + Convert.ToBase64String(credentialBuffer);

So what you're doing is manually creating a header for your HttpWebRequest and inserting the content as it would appear in a Basic Authentication header. Works like a charm.

Crookback

Excellent, this one worked, the accepted answer didn't work for me. – Elnora

This should be the accepted answer. Very nice one! The important thing is that you can pass it directly to the request, leaving the HttpClient static and clean. – Flowered

Answer 3

It helped me (for Unity3d mono, not ASP.Net):

request.PreAuthenticate = true;

Do not need manual set Authorization header or use CredentialCache.

Ernaline

Answer 4

A little off-topic but directly related as I'm working in .NET 7 with HttpClient. This snippet shows how to get your Windows credentials to be used for authentication with a REST API.

// MS says just just instantiate this once and use
//  that instance until you're done. So, module var
private static HttpClient _HttpCli;

HttpClientHandler hand;
hand = new HttpClientHandler();
hand.UseDefaultCredentials = true;
hand.PreAuthenticate = true;
_HttpCli = new HttpClient(hand);

Danford