IIS removes Authorization header from the http request, when the request is from outside my LAN

Question

I have an IIS 7.5 on Windows Server 2008 R2. It has the Basic, Anonymous and Windows Authentication modes enabled. I have hosted a restful WCF service in it.

I make an http request with Authorization header from my client within the LAN/VPN, all goes well. On the service side I could see that the OperationContext.Current.IncomingMessageHeaders contains the Authorization header with the right value.

When I attempt to do the same from outside the LAN/VPN, (I used a different Internet connection and also a public proxy), the OperationContext.Current.IncomingMessageHeaders seems to have missing Authorization header.

I am unsure as to what exactly removes the header. I suspect a misconfigured IIS. Any clues?

Answer 1

如果您希望服务按照问题似乎总是进行Windows身份验证，请在IIS中删除禁用所有其他身份验证模式，则来自LAN的请求正在传递，可能是因为请求该请求的人来自Internet中的同一域（简单地说）将采用最少要求的身份验证模式，在这种情况下将为匿名模式。