title: How to stop credential caching on Windows.Web.Http.HttpClient?
body: <p>I am having an issue where an app tries to access resources from the same server using different authentication methods, the two methods are:</p>
  
  <ul>
  <li>Credentials (NTLM, Basic, etc)</li>
  <li>OAuth (Bearer)</li>
  </ul>
  
  <h2>Setup HttpBaseProtocolFilter</h2>
  
  <p>The <code>HttpBaseProtocolFilter</code> is setup to:</p>
  
  <ul>
  <li>disable Caching </li>
  <li>disable automatic UI credential request popup</li>
  </ul>
  
  <p><strong>Code</strong></p>
  
  <pre><code>HttpBaseProtocolFilter filter = new HttpBaseProtocolFilter();
  filter.CacheControl.WriteBehavior = HttpCacheWriteBehavior.NoCache;
  filter.CacheControl.ReadBehavior = HttpCacheReadBehavior.MostRecent;
  filter.AllowUI = false;
  </code></pre>
  
  <h2>Adding Server Credential</h2>
  
  <p>If the resource needs credentials then I use:</p>
  
  <pre><code>filter.ServerCredential = new PasswordCredential(
                  RequestUri.ToString(),
                  UserName,
                  Password);
  
  HttpClient httpClient = new HttpClient(filter);
  </code></pre>
  
  <h2>Adding OAuth Token</h2>
  
  <p>If the resource needs a Bearer token I use:</p>
  
  <pre><code>HttpClient httpClient = new HttpClient(filter);
  httpClient.DefaultRequestHeaders.Authorization = new HttpCredentialsHeaderValue("Bearer", token);
  </code></pre>
  
  <p><em>The <code>ServerCredential</code> are null</em></p>
  
  <pre><code>filter.ServerCredential = null
  </code></pre>
  
  <h2>Getting response from server</h2>
  
  <pre><code>using(httpClient)
  {
     using(HttpRequestMessage requestMessage = new HttpRequestMessage(new HttpMethod(method), RequestUri))
     {
         using(HttpResponseMessage response = await httpClient.SendRequestAsync(requestMessage))
         {
             // Do something with response
         }
     }
  }
  </code></pre>
  
  <h2>The issue</h2>
  
  <p>If the <code>HttpClient</code> request returns a 200 (OK) using <code>ServerCredential</code>, then every following <code>Bearer</code> request also returns 200 (OK) even if the <code>Bearer</code> token is invalid and <code>filter.ServerCredential</code> is null. </p>
  
  <p>It looks as if the <code>filter.ServerCredential</code> is cached and all subsequent calls are authenticated with the cached credentials.</p>
  
  <p>I have to restart the app if I want to do a <code>Bearer</code> authentication. </p>
  
  <p><strong>How can I remove, disable or clear the <code>ServerCredential</code> of the Windows.Web.Http.HttpClient?</strong></p>
  
  <hr>
  
  <p>Things I've tried:</p>
  
  <h3>Deleting all cookies</h3>
  
  <pre><code>var cookieManager = filter.CookieManager;
  HttpCookieCollection myCookieJar = cookieManager.GetCookies(RequestUri);
  foreach (HttpCookie cookie in myCookieJar)
  {
      cookieManager.DeleteCookie(cookie);
  }
  </code></pre>
  
  <p>The <code>myCookieJar</code> is empty.</p>
  
  <h3>Something with <code>PasswordCredentialPropertyStore</code></h3>
  
  <pre><code>Windows.Security.Credentials.PasswordCredentialPropertyStore credentialPropertyStore = new Windows.Security.Credentials.PasswordCredentialPropertyStore();
  </code></pre>
  
  <p>The <code>credentialPropertyStore</code> is empty.</p>
  
  <p>AND</p>
  
  <p><code>PasswordCredentialPropertyStore</code>'s method Clear <a href="https://msdn.microsoft.com/en-us/library/windows/apps/windows.security.credentials.passwordcredentialpropertystore.clear">is reserved for internal use and is not intended to be used in your code.</a></p>
  
  <p>Any ideas?</p>