VB.NET - Can NET maintain digest-authenticated sessions?

Asked By Paul Browning on 27-Mar-05 09:05 PM
I must (as a client application) connect via HTTP, authenticate using 
DIGEST authentication, and then make subsequent HTTP requests. 
The Problem: 
If I use System.Net.WebClient or System.Net.HttpWebRequest, my initial 
HTTP request is met with a: 
HTTP/1.1 401 Unauthorized xxx 
Set-Cookie: ARPT=ZYQ123; path=/ 
Date: Sat, 26 Mar 2026 02:43:44 GMT 
Content-Length: 0 
Content-Type: text/html 
Cache-Control: private 
WWW-Authenticate: Digest realm="xyz", 
nonce="31313131383035303234343­234201d4e1fddab881c96a4ab8f32f­64eaad9", 
opaque="6e6f742075736564" 
which .NET responds to CORRECTLY by doing a DIGEST authentication. 
The problem is that subsequent requests through the .NET framework 
using either System.Net.WebClient or System.Net.HttpWebRequest do NOT 
contain DIGEST authentication headers, as they should for an 
AUTHENTICATED SESSION.  Packet traces confirm this. 
How can I get .NET to maintain the session, and not treat subsequent 
HTTP requests as if I am "starting a session from scratch?"  I hope 
that Microsoft will not force me to develop my own digest 
authentication routines, and have to manually compute and send 
authentication headers with each HTTP request.

YEs

Asked By Peter Bromberg on 28-Mar-05 09:18 AM
See here for example code. 
http://www.eggheadcafe.com/PrintSearchContent.asp?LINKID=577

What about sessions with multiple page requests?

Asked By Paul Browning on 28-Mar-05 01:09 PM
The example that you give is nearly identical to my code.   The problem occurs with the next HTTP request that is issued.  
I'm unable to keep the session going (i.e. the nonce-counter increases, and subsequent HTTP requests automatically contain the authentication headers).
.NET wants to send the subsequent page requests WITHOUT authentication headers, receive the 401 response, and then re-authenticate, starting a new session.  
How can I make my next request part of the same session & not start from scratch?  Besides being a bandwidth hog, many servers just will not let you keep creating new sessions for every single HTTP request.