title: ASP REST Service - Authentication issues
body: <p>I have found heaps of material/info on my issue, but nothing I've found seems to fix it.</p>
  
  <p>I have written an ASP REST service, that authenticates with NTLM that takes in a Jpeg as a stream (saving the image to the server), and I'm having trouble getting it to work.</p>
  
  <pre><code>namespace Services
  {
      [System.ServiceModel.Activation.AspNetCompatibilityRequirements(RequirementsMode = System.ServiceModel.Activation.AspNetCompatibilityRequirementsMode.Required)]
      [ServiceBehavior(ConcurrencyMode = ConcurrencyMode.Multiple,
          InstanceContextMode = InstanceContextMode.PerCall,
          IgnoreExtensionDataObject = true,
          IncludeExceptionDetailInFaults = true,
          AddressFilterMode = AddressFilterMode.Any)]
      public class MyService : IMyService
      {
          [OperationBehavior(Impersonation = ImpersonationOption.Allowed)]
          public bool Upload(Stream image)
          {
              //code here
              return true;
          }
      }
  }
  </code></pre>
  
  <p>The web.config is as follows:</p>
  
  <pre><code>  &lt;system.web&gt;
      &lt;compilation targetFramework="4.5"/&gt;
      &lt;httpRuntime targetFramework="4.5" executionTimeout="4800" maxRequestLength="500000000"/&gt;
      &lt;authorization&gt;
        &lt;allow users="*"/&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="defaultBehavior"&gt;
            &lt;serviceMetadata httpGetEnabled="true"/&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
            &lt;dataContractSerializer maxItemsInObjectGraph="2147483647" /&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
        &lt;endpointBehaviors&gt;
          &lt;behavior name="web"&gt;
            &lt;webHttp/&gt;
          &lt;/behavior&gt;
        &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/&gt;
      &lt;services&gt;
        &lt;service name="Service.MyService" behaviorConfiguration="defaultBehavior"&gt;
          &lt;endpoint address="" binding="webHttpBinding" bindingConfiguration="defaultWebHttpBinding" contract="MyService.IMyService" behaviorConfiguration="web" /&gt;
        &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
        &lt;webHttpBinding&gt;
          &lt;binding name="defaultWebHttpBinding"
                   closeTimeout="00:02:00"  openTimeout="00:02:00" receiveTimeout="00:02:00" sendTimeout="00:02:00" 
                   maxBufferPoolSize="250000000" maxReceivedMessageSize="250000000"&gt;
            &lt;readerQuotas maxBytesPerRead="2147483647" maxDepth="4500000" maxStringContentLength="4500000"  maxNameTableCharCount="250000000" maxArrayLength="4500000"/&gt;
            &lt;security mode="TransportCredentialOnly"&gt;
              &lt;transport clientCredentialType="Ntlm" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/webHttpBinding&gt;
      &lt;/bindings&gt;
    &lt;/system.serviceModel&gt;
    &lt;system.webServer&gt;
      &lt;security&gt;
        &lt;requestFiltering&gt;
          &lt;requestLimits maxAllowedContentLength="500000000"&gt;&lt;/requestLimits&gt;
        &lt;/requestFiltering&gt;
      &lt;/security&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"/&gt;
      &lt;!--
          To browse web app root directory during debugging, set the value below to true.
          Set to false before deployment to avoid disclosing web app folder information.
        --&gt;
      &lt;directoryBrowse enabled="true"/&gt;
      &lt;httpProtocol&gt;
        &lt;customHeaders&gt;
          &lt;add name="Access-Control-Allow-Origin" value="*"/&gt;
          &lt;add name="Access-Control-Allow-Headers" value="Content-Type, accept, authorization, origin, referer, user-agent, x-token"/&gt;
          &lt;add name="Access-Control-Allow-Methods" value="POST,GET,OPTIONS"/&gt;
        &lt;/customHeaders&gt;
      &lt;/httpProtocol&gt;
    &lt;/system.webServer&gt;
  </code></pre>
  
  <p>on IIS, its running with Windows Authentication only. And its being called from this code:
          var wcfServiceUrl = '<a href="http://server/MyService.svc/Upload/" rel="nofollow">http://server/MyService.svc/Upload/</a>';</p>
  
  <pre><code>    function uploadImage(image) {
          var xhr = new XMLHttpRequest();
          xhr.open('POST', wcfServiceUrl, true);
          xhr.send(photo);
      }
  </code></pre>
  
  <p>This works if I call it from the server locally (i.e. from a html page on the server). However if I run it from anywhere else (a test.html page locally, a hosted webpage on another server) it fails with the following:</p>
  
  <pre><code>OPTIONS http://server/MyService.svc/Upload/ 401 (Unauthorized)
  XMLHttpRequest cannot load http://server/MyService.svc/Upload/. Response for preflight has invalid HTTP status code 401
  </code></pre>
  
  <p>The header is as follows:</p>
  
  <pre><code>Remote Address:0.0.0.0
  Request URL:http://server/MyService.svc/Upload/
  Request Method:OPTIONS
  Status Code:401 Unauthorized
  
  Response Headers
  Access-Control-Allow-Headers:Content-Type, accept, authorization, origin, referer, user-agent, x-token
  Access-Control-Allow-Methods:POST,GET,OPTIONS
  Access-Control-Allow-Origin:*
  Content-Length:1293
  Content-Type:text/html
  Date:Thu, 29 Oct 2015 03:46:52 GMT
  Server:Microsoft-IIS/7.5
  WWW-Authenticate:NTLM
  X-Powered-By:ASP.NET
  
  Request Headers
  Accept:*/*
  Accept-Encoding:gzip, deflate, sdch
  Accept-Language:en-GB,en-US;q=0.8,en;q=0.6
  Access-Control-Request-Headers:content-type
  Access-Control-Request-Method:POST
  Connection:keep-alive
  Host:server
  Origin:null
  User-Agent:Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
  </code></pre>