title: Authorization header is null
body: <p><strong>Basic authentication Module</strong></p>
  
  <pre><code>public class BasicAuthHttpModule : IHttpModule
  {
      private const string Realm = "AngularWebAPI";
  
      public void Init(HttpApplication context)
      {
          // Register event handlers
          context.AuthenticateRequest += OnApplicationAuthenticateRequest;
          context.EndRequest += OnApplicationEndRequest;
      }
  
      private static void SetPrincipal(IPrincipal principal)
      {
          Thread.CurrentPrincipal = principal;
          if (HttpContext.Current != null)
          {
              HttpContext.Current.User = principal;
          }
      }
  
      private static bool AuthenticateUser(string credentials)
      {
          var encoding = Encoding.GetEncoding("iso-8859-1");
          credentials = encoding.GetString(Convert.FromBase64String(credentials));
  
          var credentialsArray = credentials.Split(':');
          var username = credentialsArray[0];
          var password = credentialsArray[1];
  
          /* REPLACE THIS WITH REAL AUTHENTICATION
          ----------------------------------------------*/
          if (!(username == "test" &amp;&amp; password == "test"))
          {
              return false;
          }
  
          var identity = new GenericIdentity(username);
          SetPrincipal(new GenericPrincipal(identity, null));
  
          return true;
      }
  
      private static void OnApplicationAuthenticateRequest(object sender, EventArgs e)
      {
          var request = HttpContext.Current.Request;
          var authHeader = request.Headers["Authorization"];
          if (authHeader != null)
          {
              var authHeaderVal = AuthenticationHeaderValue.Parse(authHeader);
  
              // RFC 2617 sec 1.2, "scheme" name is case-insensitive
              if (authHeaderVal.Scheme.Equals("basic", StringComparison.OrdinalIgnoreCase) &amp;&amp; authHeaderVal.Parameter != null)
              {
                  AuthenticateUser(authHeaderVal.Parameter);
              }
          }
      }
  
      // If the request was unauthorized, add the WWW-Authenticate header
      // to the response.
      private static void OnApplicationEndRequest(object sender, EventArgs e)
      {
          var response = HttpContext.Current.Response;
          if (response.StatusCode == 401)
          {
              response.Headers.Add("WWW-Authenticate", string.Format("Basic realm=\"{0}\"", Realm));
          }
      }
  
         public void Dispose()
         {
         }
      }
  </code></pre>
  
  <p><strong>Api controller</strong></p>
  
  <pre><code>[Authorize]
  public class SecureDataController : ApiController
  {
     public IHttpActionResult Get()
     {
      return Ok(new { secureData = "You have to be authenticated to access this!" });
      }
  }
  </code></pre>
  
  <p>HttpActionContext.Request.Headers.Authorization is always null.</p>
  
  <p>Any thoughts on this ?</p>
  
  <p>Thanks,</p>