Runtime: [UWP] HttpClientHandler - Digest Authentication Broken on Windows 10 PC

[bvenhaus]

Just recently I found that my UWP app can no longer connect with Digest authentication on Windows 10 PCs.

The exact same UWP appxbundle actually works on my old Windows 10 Mobile Phone.

The code also works fine in my Xamarin Android & iOS apps.

var handler = new HttpClientHandler();
handler.Credentials = new NetworkCredential(username, password);

var client = new HttpClient(handler);
var response = await client.GetAsync(url);
var responseString = response.ToString();
System.Diagnostics.Debug.WriteLine(responseString);

StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 1.1, Content: System.Net.Http.StreamContent, Headers:
{
  Server: lighttpd/1.4.35
  Date: Wed, 16 Sep 2020 05:53:57 GMT
  WWW-Authenticate: Digest realm="iPolis_00:16:6C:7A:A3:80", nonce="42d9bd5ae91fd3a63a695960da57850c", qop="auth"
  Content-Length: 351
  Content-Type: text/html
}

This is specific only to the UWP HttpClientHandler. On same PC that couldn't connect, the HttpClientHandler from .NET Framework 4.8 still works fine.

This is a very new issue. The UWP HttpClientHandler definitely did support Digest up until about a week ago.

My appxbundle was built with Target version 10.0.17134, Min version 10.0.15063.

Problem also persists when built with latest versions, Target version 10.0.18362, Min version 10.0.18362.

In summary...

DIGEST DOES NOT WORK

• UWP on Windows 10 Pro 2004 19041.508

DIGEST WORKS

• UWP on Windows 10 Mobile [phone]
• .NET Framework 4.8 on Windows 10 Pro 2004 19041.508
• Xamarin Android
• Xamarin iOS

This issue was also reported by another user the other day on the Microsoft Docs website.
https://docs.microsoft.com/en-us/answers/questions/93105/httpclienthandler-does-not-work-for-authentication.html

[msftbot[bot]]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

[hoyosjs]

@tommcdon

[karelz]

There are 2 parallel Http stacks in UWP -- System.Net.Http and Windows.Web.Http (which is implemented directly by Windows)
The one in System.Net.Http just wraps the Windows one in UWP.

Interestingly HttpClientHandler is not part of Windows.Web.Net, so I have no idea what your code does in UWP. However, I am fairly sure it just forwards the calls into Windows.Web.Net stack as there is nothing else it can do.
Would you be able to use the Windows.Web.Net stack directly and see if you can reproduce the regression with that? That would help us narrow down the right set of experts who should take a look ...
Thanks!

[bvenhaus]

Yeah, it's not working with Windows.Web.Net either.

var handler = new Windows.Web.Http.Filters.HttpBaseProtocolFilter();
handler.ServerCredential = new Windows.Security.Credentials.PasswordCredential() { UserName = username, Password = password };

var client = new Windows.Web.Http.HttpClient(handler);
var response = await client.GetAsync(url);
var responseString = response.ToString();
System.Diagnostics.Debug.WriteLine(responseString);

StatusCode: 401, ReasonPhrase: 'Unauthorized', Version: 2, Content: Windows.Web.Http.HttpStreamContent, Headers:
{
  Server: lighttpd/1.4.35
  Date: Wed, 16 Sep 2020 20:39:28 GMT
  WWW-Authenticate: Digest realm="iPolis_00:16:6C:7A:A3:80", nonce="d53ccd8d8e941a90d2146041c99d5518", qop="auth"
}{
  Content-Length: 351
  Content-Type: text/html
}