Web API + CORS + Basic NTLM: 401 with Firefox + Chrome - asp.net

Question

So I've been trolling every post I could find on this topic and still haven't figured it out. Hopefully you can help:
Web API 2 with CORS enabled:
config.EnableCors(new EnableCorsAttribute("*", "*", "*"));
web.config:
<system.web>
<compilation debug="true" targetFramework="4.5" />
<httpRuntime targetFramework="4.5" />
<authentication mode="Windows" />
</system.web>
jQuery
<script>
$(document).ready(function()
{
$("button").click(function()
{
var endpoint = "http://localhost:82/api/test";
var base64Credentials = window.btoa("domain\credentials:password");
$.ajax({
url: endpoint,
beforeSend: function(xhr) {
xhr.withCredentials = true;
xhr.setRequestHeader("Authorization", "Basic " + base64Credentials);
},
success: function(result) {
alert(result);
}
});
});
});
</script>
IIS has Basic Authentication enabled.
Basic Auth works in IE. Firefox and Chrome is subject to the preflight OPTIONS call.
Using Fiddler, I can see that if I set IIS to allow both Anonymous and Basic Authentication then the OPTIONS call will result in a 200 and then the subsequent GET with Basic Auth kicks in and all is right in the world. If I turn off Anonymous, then I get 401 on the OPTIONS call.
Question:
Is it a requirement to allow both Anonymous and Basic authentication to support this use case?

Answer 1

I've partially solved this on one of my projects. It always works in IE, but in Chrome I still get random 401 replies on requests but when I examine the response web api is sending the JSON data back so it gets past the OPTIONS.
The IIS site config for Web API is:
Windows Auth, anon disabled;
And under Windows Auth providers (option on the right), move NTLM to the top
In your web.config:
<httpProtocol>
<customHeaders>
<!-- Allows auth in CORS AJAX requests -->
<add name="Access-Control-Allow-Credentials" value="true" />
<!-- May only ever be one value - a domain or "*". "*" is disallowed when Access-Control-Allow-Credentials is true -->
<add name="Access-Control-Allow-Origin" value="http://localhost:63415" />
<add name="Access-Control-Allow-Headers" value="Origin, X-Requested-With, Content-Type, Accept, Access-Control-Request-Headers, Access-Control-Request-Method" />
<add name="Access-Control-Allow-Methods" value="GET, POST, PUT, DELETE, HEAD, OPTIONS" />
</customHeaders>
</httpProtocol>
and in Global.asax.cs
protected void Application_BeginRequest()
{
// When Chrome sends the OPTIONS it breaks on windows auth, so this fixes it.
if (Request.Headers.AllKeys.Contains("Origin") && Request.HttpMethod == "OPTIONS")
{
Response.StatusCode = (int)HttpStatusCode.OK;
Response.Flush();
}
}
All of that is without using the CORS NuGet package. I tried that but I still had the OPTIONS problems.
EDIT: An update on this, it all seems to be working perfectly well for me in Chrome now.