Fiddler and .Net Authentication

A comment on my previous post pointed out that if you’re running Fiddler, NewsGator Inbox cannot make any successful web service calls.  I gave it a try and that turns out to be true.  So I did a little searching and figured out how to get it working correctly.

Fiddler closes the socket connection when it gets a 401 response from the server.  This breaks how .Net handles authentication with web service calls.  When the framework makes a web service call, it first tries without authentication headers:

POST /ngws/svc/Location.asmx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.42)
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://services.newsgator.com/svc/Location.asmx/GetLocations"
Host: services.newsgator.com
Content-Length: 473
Expect: 100-continue
Proxy-Connection: Keep-Alive

When this response makes it back to the framework, it decides how to authenticate, then resends the request with the proper headers:

POST /ngws/svc/Location.asmx HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol 2.0.50727.42)
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://services.newsgator.com/svc/Location.asmx/GetLocations"
Authorization: Digest <…>
Host: services.newsgator.com
Content-Length: 473
Expect: 100-continue

When Fiddler is running and closes the socket, the framework throws an exception “The underlying connection was closed: An unexpected error occurred on a send.”

To fix this, you have to tell Fiddler not to close the connection on 401s, but you also need to make sure that NTLM authentication still works correctly.  To do this, add the following to your custom rules in the OnBeforeResponse function:

if ((oSession.responseCode == 401)&&(oSession.oResponse["WWW-Authenticate"].indexOf("NTLM")==-1))
{
    oSession.oResponse["Connection"] = "close";
}

That will get everything working as expected.