Re: client gets always every first time for every page a 401

From: BB (qbernard_at_hotmail.com)
Date: 05/28/03

  • Next message: BB: "Re: unzipping of files from IIS" 
    Date: Wed, 28 May 2003 12:26:18 +0800

    This is normal, cause the browse will always try anonymous access first.

    Read
    INFO: How IIS Authenticates Browser Clients
    http://support.microsoft.com/?id=264921 

    -- 
Regards,
Bernard Cheah
http://support.microsoft.com/
"megloff" <joes@bluewîn.ch> wrote in message
news:uCvlmpGJDHA.3272@tk2msftngp13.phx.gbl...
> Hello there
>
> I have an issue with the basic authentication from IIS. I working with
> IIS 4.0 on WinNT 4 Server SP3. My WebSite instance in the IIS has the
> basic authentication activated.
>
> When I try now to access with a new Browser Instance to my Website, I
> get for every first page the first time an 401.
> I think there is something wrong configurated, because I expect that it
> is only necessary to authenticate to my root of the website and not for
> each page or request on my site.
> Is this correct? Or is this normal that my Browser has to authenticate
> for every request ?
>
> Here an example sequence to make it more understandable:
>
> 1.[Browser] Get /myRoot/myFolder/MyDoc.html
> 2.[Server]  401 (Basic Realm)
> 3.[Browser] Get /myRoot/myFolder/MyDoc.html Basic:xxxxxxx
> 4.[Server]  200 Ok
> 5.[Browser] Get /myRoot/myFolder/mySubFolder
> 6.[Server]  401 (Basic Realm)
> 7.[Browser] Get /myRoot/myFolder/mySubFolder Basic:xxxxxx
> 8.[Server]  200 Ok
> ... // If I am accessing the same page the second time it works
>
> x.[Browser] Get /myRoot/myFolder/mySubFolder Basic:xxxxxx
> xi.[Server] 200 Ok
>
> Why does my Browser in case 5 not submit the Basic Authorization String
> automatically? So the Browser should know that he can use the same
> credentials as used in 3, because they have the same root. Is this
> because a header is missing from the IIS?
>
> I attached You also some lines from the IIS logs which makes it more
> understandable as my pretty created sequence above:
>
> 2003-05-26 15:58:32 166.11.47.199 -
> /banking_content_management/common/login_action/0,,,00.html 302 217 1922
> 2003-05-26 15:58:32 166.11.47.199 -
> /csam_content_management/csam_content_management_home 401 797 16
> 2003-05-26 15:58:32 166.11.47.199 szrh91604\logicacma
> /csam_content_management/csam_content_management_home/ 302 402 0
> 2003-05-26 15:58:32 166.11.47.199 szrh91604\logicacma
> /csam_content_management/csam_content_management_home/0,,,00.html 200
> 16943 16
> 2003-05-26 15:58:32 166.11.47.199 szrh91604\logicacma
> /banking_content_management/common/images/csam.gif 200 1746 31
> 2003-05-26 15:58:32 166.11.47.199 szrh91604\logicacma
> /banking_content_management/common/images/provider.gif 304 141 16
>
> Thank for you any comments if this is a normal behaviour or if we can
> achieve this.
>
> Thank you regards
> Mark
>
>
>
> *** Sent via Developersdex http://www.developersdex.com ***
> Don't just participate in USENET...get rewarded for it!
  • Next message: BB: "Re: unzipping of files from IIS"

    Relevant Pages

    • Re: Cant make a domain user the "anonymous access" user
      ... When dealing with authentication issues it is VERY important to ... Some of the things you claim is not consistent with a default IIS ... If you use a browser that cannot do NTLM, by definition, a 401.2 error is ... user account that works and your domain account that does not. ...
      (microsoft.public.inetserver.iis.security)
    • RE: logout a browser under integrated security
      ... due to the browser. ... but not server ... >server by using Basic or NTLM authentication, ... >IIS Authenticates Browser Clients" ...
      (microsoft.public.inetserver.iis.security)
    • Re: a WWW-Authenticate header field that the server is not configu
      ... "Web browser is sending a WWW-Authenticate header field that the Web ... Read the IIS documentation on how to set up Client Certificate ... and if you turn off all IIS Authentication Methods as well as ... "Web browser is sending a WWW-Authenticate header field that the Web ...
      (microsoft.public.inetserver.iis.security)
    • Re: NT Authentication with ASP
      ... Without credentials, IIS will assume anonymous access. ... If Anonymous authentication is enabled, ... unless the browser has already authenticated. ...
      (microsoft.public.inetserver.asp.general)
    • Re: HELP PLEASE The request failed with HTTP status 401: Access Denied.
      ... Web Security: Part 2: Introducing the Web Application Manager, Client ... Authentication Options, and Process Isolation ... It introduces the Web Application Manager in IIS that ... logon session, which is dangerous. ...
      (microsoft.public.dotnet.framework.aspnet.security)