I have an ASP.NET API that uses basic authentication to authenticate user requests. A new design requirement means I now have to authenticate with 3 fields (not just the username and password).

What is the best way to approach this? I've tried inserting the third field into the body and reading it on request. This works, but it feels wrong. Is there a way in which the third field could be part of the authorization header?

EDIT

I added the third field to the username (delimited with '|'). A HTTP module decodes and splits the header upon arrival, thus allowing for 3 field request authentication. Simple solution.