C# 如何使用 HttpWebRequest.Credentials 属性进行基本身份验证？
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/19764113/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to use HttpWebRequest.Credentials Property for Basic Authentication?
提问by Jos Vinke
How can I use the Webrequest CredentialsProperty to send an basic authentication header?
Why isn't the Authorization header send with the request even whenPreAuthenticateis set to true?
如何使用 WebrequestCredentials属性发送基本身份验证标头？为什么 Authorization 标头即使PreAuthenticate设置为 true也不随请求一起发送？
WebRequest request = (HttpWebRequest)WebRequest.Create("https://api.github.com/user");
request.Credentials = new NetworkCredential("githubUsername", "githubPassword");
request.PreAuthenticate = true;
var response = request.GetResponse();
采纳答案by Jos Vinke
The server should send a HTTP 401 Not Authorized response code containinga WWW-Authenticate HTTP header.
服务器应发送包含WWW-Authenticate HTTP 标头的 HTTP 401 未授权响应代码。
WWW-Authenticate: Basic realm="example"
The PreAuthenticate property only works afterauthentication has taken place. From MSDN:
PreAuthenticate 属性仅在进行身份验证后才起作用。来自 MSDN：
true to send an HTTP Authorization header with requests after authentication has taken place; otherwise, false. The default is false.
true 在身份验证发生后发送带有请求的 HTTP 授权标头；否则为假。默认值为假。
See other answers for more in depth explanation.
有关更深入的解释，请参阅其他答案。
回答by M?ns T?nneryd
I can successfull run this code accessing another server that also requires both SSL and authentication. This server differs from the github in that the github returns a json result saying that it requires authentication and the other server returns a "classic" 401 html page. Sniffing the network you can see that the .net code tries to do anonymous auth even if you do set preauth to true which I think is rather confusing. However, upon receiving a regular 401-page it tries again, and this time with the auth info and everything works. It seems to me though as if .net reacts differently upon receiving the json version of a 401, not making a second try.
我可以成功地运行此代码访问另一个也需要 SSL 和身份验证的服务器。该服务器与github的不同之处在于，github返回一个json结果说它需要身份验证，而另一个服务器返回一个“经典”的401 html页面。嗅探网络，您可以看到 .net 代码尝试进行匿名身份验证，即使您确实将 preauth 设置为 true，我认为这很令人困惑。但是，在收到常规 401 页后，它会再次尝试，这次使用身份验证信息，一切正常。在我看来，好像 .net 在收到 401 的 json 版本时会有不同的反应，而不是再次尝试。
I guess this is not the answer you are looking for but hopefully it sheds some more light on the situation.
我想这不是您正在寻找的答案，但希望它能对情况有所了解。
回答by Jos Vinke
I've done some additional research based on M?ns T?nneryd`s answer. And the link he posted in his comment: PreAuthenticate Property of WebRequest - Problem.
我根据M?ns T?nneryd的回答做了一些额外的研究。以及他在评论中发布的链接：PreAuthenticate Property of WebRequest - Problem。
First of all as described in his link the HttpWebRequest.PreAuthenticate Propertydoes NOT send the Authentication header PRE authentication, but pre sends it in following requests, after Authentication. From MSDN:
首先，如他的链接中所述，HttpWebRequest.PreAuthenticate 属性不发送身份验证标头 PRE 身份验证，而是在身份验证后在以下请求中预先发送它。来自 MSDN：
true to send an HTTP Authorization header with requests after authentication has taken place; otherwise, false. The default is false.
true 在身份验证发生后发送带有请求的 HTTP 授权标头；否则为假。默认值为假。
So even with the PreAuthenticateproperty set to true, we still need an WWW-Authenticate challenge with a 401 Unauthorized before anything happens. Now if we try to authenticate against github with the following code:
因此，即使将PreAuthenticate属性设置为 true，在发生任何事情之前，我们仍然需要一个带有 401 Unauthorized 的 WWW-Authenticate 质询。现在，如果我们尝试使用以下代码对 github 进行身份验证：
WebRequest request = (HttpWebRequest)WebRequest.Create("https://api.github.com/user");
request.Credentials = new NetworkCredential("githubUsername", "githubPassword");
var response = request.GetResponse();
An WebExceptionwill be thrown, because we don't get a WWW-Authenticate challenge. If we capture this in Fiddler we will get the following:
一个WebException会被抛出，因为我们没有得到一个WWW身份验证的挑战。如果我们在 Fiddler 中捕获它，我们将得到以下信息：
However if we try this, with the exact same code, against a website that does return a WWW-Authenticate challenge we will see the following in Fiddler:
但是，如果我们使用完全相同的代码针对确实返回 WWW-Authenticate 质询的网站尝试此操作，我们将在 Fiddler 中看到以下内容：
And the response will have the result as expected.
并且响应将具有预期的结果。
