Angular App with .NET 9 Backend Using Windows Authentication Triggers login Popupon browser...

I'm facing an issue with Windows Authentication in a full-stack app:

Tech Stack:

Frontend: Angular 9.1

Backend: ASP.NET 9 (hosted on IIS)

Authentication: Windows Authentication (WinAuth)

Hosting: Angular app is served together with the backend from IIS

withCredentials: true is added via an HTTP interceptor to all requests


The Problem:

When using the app:

Randomly an action that triggers a POST to /api/UserModel/SaveUserModel, the browser popup appears asking for Windows credentials

If I cancel the popup, the request fails with a 401 2 5 (seen in IIS logs)

However, this same POST works fine sometimes.


What I’ve Tried:

withCredentials: true is confirmed on the request (seen in DevTools)

Backend logs show that during failed requests, the request does not reach any middleware

IIS logs confirm:

Successful request: 200 0 0

Failing request: 401 2 5 (WinAuth failed to receive credentials)

I cannot modify browser Internet Settings (group policy restrictions prevent adding the site to the "Local Intranet" zone)

Anonymous Authentication is enabled, but disabling it doesn’t fix the popup either

I also used remote debugging and deployed a debug version of both front and backend, but the specific request doesn't reach backend apparently.

• App Pool Settings:

Idle Timeout: set to 0 (no timeout)


Theories:

Browser doesn’t send credentials after idle time or random interaction patterns

Credentials are cached, but somehow invalidated or dropped between Angular actions

Windows Authentication re-negotiation triggers a popup when automatic logon isn't allowed


What I Need Help With:

Why is the browser triggering a Windows Auth popup randomly?

What conditions could cause withCredentials: true to not actually send credentials, even though it’s set?

Is there a way to force Angular or the browser to retry with current credentials silently without prompting?


Any ideas, best practices, or similar experiences would be very helpful.

Thank you

Continue reading...