Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am developing web api by using Asp.Net WebApi (RC) and passing user credentials via http "Authorization" header. I am getting trouble on receiving "Authorization" http header on server side. I am able to receive it when testing on local machine. Even works fine when hosted on production server and accessing url by internal IP address. BUT does not work when published on public domain.

So I guess, this has something to do with IIS or ISA server.

Also, if I create 2 web sites in IIS with one published on domain and one internal (both pointing to same physical directory) then also it work on the site hosted internally but not on published (publicly) one.

So I guess it has something to do with ISA server (I am very very new to ISA server) but not sure if it can modify http header information.

Any help appreciated.


share|improve this question
I have the exact same problem here, did you ever solve it? – hoetz Mar 12 '13 at 19:59

You haven't really provided enough information about your environment and more specifically the ISA box itself to help troubleshoot this.

However, my first guess would be that the ISA box is stripping some of the header information. If the local version works that means most likely this is not an IIS issue.

Feel free to post more information about your setup.

share|improve this answer
Thanks. I know nothing of ISA but I will get to my network admin and gather the same. – user1589040 Aug 15 '12 at 22:24

I had the same problem (with latest release of the web api). I tracked it down to an ISA Server 2006 publishing rule and fixed it with the following steps:

  • go to properties of the publishing rule and set Authentication Delegation to "No delegation, but direct Authentication of the client"
  • stay in the properties dialog and go to listener -> properties -> authentication -> advanced -> check the checkbox "Allow Clientauthentication via HTTP"

That did it. After that, the authorization headers were no longer dropped.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.