The default usage of HttpClient
and HttpWebRequest
.NET classes is setting Credentials
property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization the following happens (those classes do this under the hood and Fiddler shows what's going on):
- the first request is sent without Authorization header
- the server declines and responds with HTTP 401
- the client resends the very same request this time with Authorization header containing the properly encoded data from
Credentials
property
and this is the default behavior. So unless the user validates his application and takes extra steps every request is sent twice - the first one is universally rejected.
My question is - what's the reason for such default behavior? The client class has its Credentials
property set so it kind of assumes the user wants to use those credentials for authentication. Why not just send the appropriate header with the first request? Would doing the latter somehow compromise the client?