Under Review
Last Updated: 07 Feb 2018 06:00 by Eric
Imported User
Created on: 06 Feb 2018 04:55
Type: Feature Request
2
Fiddler only sends Session-Based-Authentication header when NTLM is the first WWW-Authenticate header
Observing session based authentication such as NTLM only works when the first WWW-Authenticate header in the 401 response is either either NTLM or Negotiate. For example, if I set up my server to send the headers in the following order:

WWW-Authenticate: NTLM
WWW-Authenticate: Bearer

Then the Proxy-Support: Session-Based-Authentication header is added by Fiddler and NTLM authentication succeeds. If I instead reorder them:

WWW-Authenticate: Bearer
WWW-Authenticate: NTLM

In this case the Proxy-Support: Session-Based-Authentication header is not added by Fiddler. If the client only supports NTLM and not bearer authentication, then the connection will fail unexpectedly.

In conclusion: It looks like fiddler is checking only the first WWW-Authenticate header when deciding whether or not to send Proxy-Support: Session-Based-Authentication. It should be checking all of the WWW-Authenticate headers.
1 comment
Eric
Posted on: 07 Feb 2018 06:00
Yup, that's probably the case.