title: Internet Explorer 11 replaces Authorization header
body: <p>What would cause Internet Explorer to replace the HTTP header</p>
  
  <p><code>Authorization : Bearer &lt;server-provided-token&gt;</code></p>
  
  <p>with</p>
  
  <p><code>Authorization : Negotiate &lt;some token&gt;</code> </p>
  
  <p>when making an AJAX request?</p>
  
  <p><strong>Details</strong></p>
  
  <p>In Internet Explorer, some AJAX requests that are configured to contain the header <code>Authorization: Bearer ...</code> are being sent by Internet Explorer with the header <code>Authorization: Negotiate ...</code> instead.</p>
  
  <p>For example, Fiddler shows that the first two of three requests contain the <code>Authorization : Bearer...</code> header, while the third suddenly contains the <code>Authorization : Negotiate...</code> header. The first two requests are successful, and the third fails because the request can't be properly authenticated.</p>
  
  <p>All of the requests are constructed using the same client-side code, and are made one after another (within the span of a second). I have verified that the <code>Authorization</code> header correctly contains the <code>Bearer</code> token in all three cases up until the point the request is provided to the browser.</p>
  
  <p>Also, I'm not seeing the same behavior in Chrome; it's only occurring in IE.</p>
  
  <p><strong>Request 1</strong></p>
  
  <pre>
  GET http://localhost/myapp/api/User HTTP/1.1
  Accept: application/json, text/plain, */*
  Authorization: Bearer oEXS5IBu9huepzW6jfh-POMA18AUA8yWZsPfBPZuFf_JJxq-DKIt0JDyPXSiGpmV_cpT8FlL3D1DN-Tv5ZbT73MTuBOd5y75-bsx9fZvOeJgg04JcO0cUajdCH2h5QlMP8TNwgTpHg-TR9FxyPk3Kw6bQ6tQCOkOwIG_FmEJpP89yrOsoYJoCfrAoZ7M4PVcik9F9qtPgXmWwXB2eHDtkls44wITF_yM_rPm5C47OPCvMVTPz30KwoEPi6fHUcL3qHauP-v9uypv2e48TyPHUwLYmNFxyafMhBx4TkovnRcsdLHZiHmSjMq0V9a2Vw70
  Referer: http://localhost/client/login.html
  Accept-Language: en-US
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
  Host: localhost
  DNT: 1
  Connection: Keep-Alive
  </pre>
  
  <p><strong>Request 2</strong></p>
  
  <pre>
  POST http://localhost/myapp/api/Permissions HTTP/1.1
  Referer: http://localhost/client/#/Dashboard
  Content-Type: application/json
  Authorization: Bearer oEXS5IBu9huepzW6jfh-POMA18AUA8yWZsPfBPZuFf_JJxq-DKIt0JDyPXSiGpmV_cpT8FlL3D1DN-Tv5ZbT73MTuBOd5y75-bsx9fZvOeJgg04JcO0cUajdCH2h5QlMP8TNwgTpHg-TR9FxyPk3Kw6bQ6tQCOkOwIG_FmEJpP89yrOsoYJoCfrAoZ7M4PVcik9F9qtPgXmWwXB2eHDtkls44wITF_yM_rPm5C47OPCvMVTPz30KwoEPi6fHUcL3qHauP-v9uypv2e48TyPHUwLYmNFxyafMhBx4TkovnRcsdLHZiHmSjMq0V9a2Vw70
  Accept: application/json, text/plain, */*
  Accept-Language: en-US
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
  Host: localhost
  Content-Length: 1419
  DNT: 1
  Connection: Keep-Alive
  Pragma: no-cache
  
  &lt;Post Data Removed&gt;
  </pre>
  
  <p><strong>Request 3</strong></p>
  
  <pre>
  GET http://localhost/myapp/api/UserPreferences/Dashboard HTTP/1.1
  Referer: http://localhost/client/#/Dashboard
  Content-Type: application/json
  Authorization: Negotiate YHsGBisGAQUFAqBxMG+gMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI7BDlOVExNU1NQAAEAAACXsgjiBgAGADMAAAALAAsAKAAAAAYBsR0AAAAPVk1ERVZFTlYtU1JTQ0VSSVM=
  Accept: application/json, text/plain, */*
  Accept-Language: en-US
  Accept-Encoding: gzip, deflate
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
  Connection: Keep-Alive
  DNT: 1
  Host: localhost
  </pre>
  
  <p>The requests are being made via the AngularJS <code>$http</code> service, and the back-end is ASP.NET Web API hosted in IIS. </p>