title: 401.2 Invalid Authentication Headers - Fixed by Fiddler
body: <p>I have a Web Api 2 service and a javascript website.  Both are hosted on an internal IIS server for internal customers.  I need to be able to get the Windows User from the site to the service via Windows Authentication.</p>
  
  <p>When I browse to the service metadata operation in Chrome (For example:  <a href="http://theServer.domain.net/myController/metadata" rel="nofollow noreferrer">http://theServer.domain.net/myController/metadata</a>) I get the correct result along with the user information.</p>
  
  <p>But when I try to load that data in my application I get the following error:</p>
  
  <blockquote>
    <p>401.2 You are not authorized to view this page due to invalid authentication headers.</p>
  </blockquote>
  
  <p>However, this only fails in Chrome.  IE 11 loads it just fine.</p>
  
  <p>This is what I have tried / have setup:</p>
  
  <ul>
  <li><p>The most common fix for this is to make sure that you have Windows Authentication turned on for IIS.  I have double checked that this is on.  And that my IIS Web Site has both the windows authentication modules.</p></li>
  <li><p>I am running both the app pools (one for the service and one for the site) as Application Pool Identity security.  And I have made sure that the app pools have access to the files on the the disk.  (Just to be sure, I even tried it with them setup to run as me.)</p></li>
  <li><p>I have also setup my web site with <code>&lt;authentication mode="Windows" /&gt;</code> in the web.config.</p></li>
  <li><p>My website is setup with both Windows and Anonymous Authentication.  And my service is setup for only Windows Authentication.  </p></li>
  <li><p>On both server and website the Windows Authentication is setup so that the only provider is NTLM.</p></li>
  <li><p>On both application pools I have turned on enable 32 bit applications. </p></li>
  </ul>
  
  <p>Since none of this was working, I tried to fire up Fiddler to see if I could look at the headers and debug on a lower level.  <strong>But once Fiddler was running, the problem went away!</strong>  The error was gone and the server was getting the authentication correct!  However, it only works while fiddler is running. (I tried reading <a href="http://www.telerik.com/blogs/help!-running-fiddler-fixes-my-app-" rel="nofollow noreferrer">Help! Running Fiddler fixes my App</a>, but I could not see anything that would help.)</p>
  
  <p><strong>So, my question is, what do I need to do to get this working with Windows Authentication?</strong>  (I need the user information.)</p>