title: Why HTML5 video tag generates anonymous requests in Safari?
body: <p>We have an intranet web application hosted in IIS 7.5, it is possible to access the application from the internet through TMG. The web site has functionality to play mp4 video using HTML5 player. The source of the video is another web application that is hosted in a virtual directory of the main application.</p>
  
  <p>It works fine on Windows in IE11 and Chrome, but if opened in Safari on Mac from within the network it begins to prompt for credentials from one to four times. And it doesn't matter whether or not valid credentials are provided, video then can be played. When working with site from the internet, it works as expected, without pop-ups.</p>
  
  <p>We have enabled Failed request tracing on IIS and found that Safari sends anonymous requests for the video immediately followed by authenticated requests, anonymous requests are rejected with error 401, whereas valid requests get response 200.</p>
  
  <p>On server we have windows authentication enabled (Negotiate, NTLM) and anonymous (for some resources only). Disabling anonymous authentication didn't change anything as well as leaving only Negotiate provider.</p>
  
  <p>Why does Safari sends multiple request for the video content and some of them without Authorization header when IE and Chrome send only one request with proper header? Can this behavior be changed?</p>
  
  <p>Server configuration: Windows Server 2008R2x64, IIS 7.5</p>
  
  <p>Client configuration: OS X El Capitan Version 10.11.6, Safari 10.0.1 (11602.2.14.0.7)</p>