I have a sub-directory of my IIS7 website that I want to lock-down with basic authentication. I've gone into IIS manager, chosen Authentication the designated directory and enabled Basic Authentication and disabled all other kinds. When I browse to the directory from the server, I get the username/password prompt. When I use a browser on a remote machine, however, I don't get the username/password prompt.
I've used Fiddler to look at the HTTP traffic, and the WWW-Authenticates header is not getting sent to the remote browser.
I've searched and searched through the configuration and can't find any setting that would be causing this. What is stopping the prompt from appearing?
We've tried turning off all other sites on that server to ensure the correct website is being hit. After viewing the HTTP log, I can see our request come in: it results in a 500 error from our application (because the user isn't logged in). This leads me to believe the web server is not properly challenging the browser because our application code is executing.