Why am I getting a 401 unauthorized when using HttpResponseMessage with a secure url?

Question

I have this proprietary code I am working on for my job. I am writing test cases for it because the code was changed and the test cases are now broken. It is a C# web Api MVC .Net Framework app

I have a method that I enter a string url in Then this code executes

HttpResponseMessage response = await Client.GetAsync(url).ConfigureAwait(true);
System.Uri uri = new System.Uri(url); // convert string to Uri
var cert = System.Net.ServicePointManager.FindServicePoint(uri).Certificate;
response.EnsureSuccessStatusCode();

when it gets to response.EnsureSuccessStatusCode() , it gives a 401 unauthorized and then throws an exception not allowing my test to pass When I try the same thing with http://www.google.com which is not an https, then it gives a 200. So something is going on with security stuff

What are the things I need to do to get a https to give a 200? Does it need username and password credentials or something or some other token of some sort?

Also, when I test it using Rest Client DHC with the secure https link that was failing above it gives me a 200. However, I had to refresh the bearer token for it to give a 200. If I used an old token it would give a 401.

Furthermoore, when I test a different link like https://www.facebook.com (which is not the one I want to test in my application, just troubleshooting) which is secure, it works giving me a 200 both in my application above and Rest Client DHC even with an old bearer token.

Answer 1

If you're trying to makes CORS requests to web API, you'll need to configure It to accept cross origins requests. If you dont configure your web api to accept cross origin requests, it'll throw these type of errors when calling It. And keep in mind that for web api access, https://www.domain.so and http://www.domain.so are completely diff clients.

Look at this link:

https://docs.microsoft.com/en-us/aspnet/web-api/overview/security/enabling-cross-origin-requests-in-web-api