proxyConfig with Windows authentication stopped working after update to 8

[LukeDi]

🐞 Bug report

Command (mark with an x)

- [ ] new
- [ ] build
- [X] serve
- [ ] test
- [ ] e2e
- [ ] generate
- [ ] add
- [ ] update
- [ ] lint
- [ ] xi18n
- [ ] run
- [ ] config
- [ ] help
- [ ] version
- [ ] doc

Is this a regression?

Yes, the previous version in which this bug was not present was: 7.1.4

Description

When using ng serve with a proxy config to forward all api calls to a .net api hosted on local IIS with windows authentication the browser constantly displays the login dialog.

🔬 Minimal Reproduction

Create project in ng7 and forward all api calls to IIS with windows authentication using config below, works fine. Update to 8 and authentication fails.

module.exports = {
    '/api/*': {
        target: "http://localhost/api/",
        secure: false,
        logLevel: "debug",
        changeOrigin: true,
        agent: new Agent({
            maxSockets: 100,
            keepAlive: true,
            maxFreeSockets: 10,
            freeSocketTimeout: 30000,
            timeout: 60000,
            keepAliveMsecs: 300000,
            
        }),
        onProxyRes: proxyRes => {
            let key = 'www-authenticate';
            proxyRes.headers[key] = proxyRes.headers[key] && proxyRes.headers[key].split(',');
        }
    }
};

🔥 Exception or Error

🌍 Your Environment

Failing environment:

Angular CLI: 8.0.0
Node: 12.3.1
OS: win32 x64
Angular: 8.0.0
... animations, cli, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.800.0
@angular-devkit/build-angular     0.800.0
@angular-devkit/build-optimizer   0.800.0
@angular-devkit/build-webpack     0.800.0
@angular-devkit/core              8.0.0
@angular-devkit/schematics        8.0.0
@angular/cdk                      7.2.0
@ngtools/webpack                  8.0.0
@schematics/angular               8.0.0
@schematics/update                0.800.0
rxjs                              6.5.2
typescript                        3.4.5
webpack                           4.30.0

Working environment:

Angular CLI: 7.1.4
Node: 12.3.1
OS: win32 x64
Angular: 7.1.4
... animations, cli, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.11.4
@angular-devkit/build-angular     0.11.4
@angular-devkit/build-optimizer   0.11.4
@angular-devkit/build-webpack     0.11.4
@angular-devkit/core              7.1.4
@angular-devkit/schematics        7.1.4
@ngtools/webpack                  7.1.4
@schematics/angular               7.1.4
@schematics/update                0.11.4
rxjs                              6.3.3
typescript                        3.1.6
webpack                           4.23.1

Anything else relevant?

Updated weback-dev-server to 3.3.1 and agentkeepalaive to 4.0.2 to match ng 8.0 in 7.1.4, everything still works in 7.1.4

[fredjeck]

Hello,

I'm experiencing the same problem after updating my 7.2.x app to 8.

Angular CLI: 8.0.3
Node: 12.4.0
OS: win32 x64
Angular: 8.0.1
... animations, common, compiler, compiler-cli, core, forms
... language-service, platform-browser, platform-browser-dynamic
... router, service-worker

Package                           Version
-----------------------------------------------------------
@angular-devkit/architect         0.800.3
@angular-devkit/build-angular     0.800.3
@angular-devkit/build-optimizer   0.800.3
@angular-devkit/build-webpack     0.800.3
@angular-devkit/core              7.3.9
@angular-devkit/schematics        7.3.9
@angular/cli                      8.0.3
@angular/pwa                      0.13.9
@ngtools/webpack                  8.0.3
@schematics/angular               7.3.9
@schematics/update                0.800.3
rxjs                              6.5.2
typescript                        3.4.5
webpack                           4.30.0

Application is started using

ng serve --proxy-config proxy.conf.js

The proxy configuration file is similar to the one posted by LukeDi
The first call to the proxied API pops up the basic authentication dialog. It looks like the credentials are never passed to the proxied environment.

Looks like the credentials are not transferred to the proxied environment

[fredjeck]

I did further testing using different browsers. While Google Chrome and Firefox(with negotiate and ntlm configured) are having a similar behavior (endless password prompt), Internet Explorer is working (at least after an initial password prompt)
Some logs below :
Google Chrome

[HPM] Proxy created: /api  ->  http://localhost:33678
[HPM] Subscribed to http-proxy events:  [ 'error', 'proxyRes', 'close' ]
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate, NTLM"
www-authenticate ["Negotiate"," NTLM"]
End onProxyRes
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate oYIBFzCCAROgAwoBAaEMBgorBgEEAYI3AgIKooH9BIH6TlRMTVNTUAACAAAAEAAQADgAAAAVwoniaJ+5X4riz4R7AAEAAAAAALIAsgBIAAAACgBjRQAAAA9BAEQALQBTAFcASQBTAFMAAgAQAEEARAAtAFMAVwBJAFMAUwABABoAUwBXAEkAUwBTAC0AUwBJAEUARwAtADEANAAEABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0AAwA0AFMAVwBJAFMAUwAtAFMASQBFAEcALQAxADQALgBhAGQALgBzAHcAaQBzAHMALgBjAG8AbQAFABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0ABwAIAKn4ewtgJ9UBAAAAAA=="
www-authenticate ["Negotiate oYIBFzCCAROgAwoBAaEMBgorBgEEAYI3AgIKooH9BIH6TlRMTVNTUAACAAAAEAAQADgAAAAVwoniaJ+5X4riz4R7AAEAAAAAALIAsgBIAAAACgBjRQAAAA9BAEQALQBTAFcASQBTAFMAAgAQAEEARAAtAFMAVwBJAFMAUwABABoAUwBXAEkAUwBTAC0AUwBJAEUARwAtADEANAAEABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0AAwA0AFMAVwBJAFMAUwAtAFMASQBFAEcALQAxADQALgBhAGQALgBzAHcAaQBzAHMALgBjAG8AbQAFABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0ABwAIAKn4ewtgJ9UBAAAAAA=="]
End onProxyRes
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate, NTLM"
www-authenticate ["Negotiate"," NTLM"]
End onProxyRes

## At this point the password prompt appears, the user types its credentials

[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate TlRMTVNTUAACAAAAEAAQADgAAAAVgoniWyfcF0P3PWkAAAAAAAAAALIAsgBIAAAACgBjRQAAAA9BAEQALQBTAFcASQBTAFMAAgAQAEEARAAtAFMAVwBJAFMAUwABABoAUwBXAEkAUwBTAC0AUwBJAEUARwAtADEANAAEABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0AAwA0AFMAVwBJAFMAUwAtAFMASQBFAEcALQAxADQALgBhAGQALgBzAHcAaQBzAHMALgBjAG8AbQAFABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0ABwAIALMV/hpgJ9UBAAAAAA=="
www-authenticate ["Negotiate TlRMTVNTUAACAAAAEAAQADgAAAAVgoniWyfcF0P3PWkAAAAAAAAAALIAsgBIAAAACgBjRQAAAA9BAEQALQBTAFcASQBTAFMAAgAQAEEARAAtAFMAVwBJAFMAUwABABoAUwBXAEkAUwBTAC0AUwBJAEUARwAtADEANAAEABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0AAwA0AFMAVwBJAFMAUwAtAFMASQBFAEcALQAxADQALgBhAGQALgBzAHcAaQBzAHMALgBjAG8AbQAFABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0ABwAIALMV/hpgJ9UBAAAAAA=="]
End onProxyRes
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate, NTLM"
www-authenticate ["Negotiate"," NTLM"]
End onProxyRes

Internet Explorer

[HPM] Proxy created: /api  ->  http://localhost:33678
[HPM] Subscribed to http-proxy events:  [ 'error', 'proxyRes', 'close' ]
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate, NTLM"
www-authenticate ["Negotiate"," NTLM"]
End onProxyRes
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate oYIBFzCCAROgAwoBAaEMBgorBgEEAYI3AgIKooH9BIH6TlRMTVNTUAACAAAAEAAQADgAAAAVwoniJ8/i+M3zH0lpAAEAAAAAALIAsgBIAAAACgBjRQAAAA9BAEQALQBTAFcASQBTAFMAAgAQAEEARAAtAFMAVwBJAFMAUwABABoAUwBXAEkAUwBTAC0AUwBJAEUARwAtADEANAAEABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0AAwA0AFMAVwBJAFMAUwAtAFMASQBFAEcALQAxADQALgBhAGQALgBzAHcAaQBzAHMALgBjAG8AbQAFABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0ABwAIAN4QYORWJ9UBAAAAAA=="
www-authenticate ["Negotiate oYIBFzCCAROgAwoBAaEMBgorBgEEAYI3AgIKooH9BIH6TlRMTVNTUAACAAAAEAAQADgAAAAVwoniJ8/i+M3zH0lpAAEAAAAAALIAsgBIAAAACgBjRQAAAA9BAEQALQBTAFcASQBTAFMAAgAQAEEARAAtAFMAVwBJAFMAUwABABoAUwBXAEkAUwBTAC0AUwBJAEUARwAtADEANAAEABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0AAwA0AFMAVwBJAFMAUwAtAFMASQBFAEcALQAxADQALgBhAGQALgBzAHcAaQBzAHMALgBjAG8AbQAFABgAYQBkAC4AcwB3AGkAcwBzAC4AYwBvAG0ABwAIAN4QYORWJ9UBAAAAAA=="]
End onProxyRes
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate, NTLM"
www-authenticate ["Negotiate"," NTLM"]
End onProxyRes

## At this point the password prompt appears, the user types its credentials

[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate oYG2MIGzoAMKAQChCwYJKoZIgvcSAQICooGeBIGbYIGYBgkqhkiG9xIBAgICAG+BiDCBhaADAgEFoQMCAQ+ieTB3oAMCARKicARuyivBH37Wpp+3dmyMTQxiCyVljCHDv/hzWgDixoj6bfiNHtm9n3shtiqNjBSyid3AH13JbxMPR4P2/lOf19i5KdKkb+cwyvAu9nE73WXtNe7OzJfwU2n74Vj7b0xdVGMD41a9pBBG8opGmL2DbKk="
www-authenticate ["Negotiate oYG2MIGzoAMKAQChCwYJKoZIgvcSAQICooGeBIGbYIGYBgkqhkiG9xIBAgICAG+BiDCBhaADAgEFoQMCAQ+ieTB3oAMCARKicARuyivBH37Wpp+3dmyMTQxiCyVljCHDv/hzWgDixoj6bfiNHtm9n3shtiqNjBSyid3AH13JbxMPR4P2/lOf19i5KdKkb+cwyvAu9nE73WXtNe7OzJfwU2n74Vj7b0xdVGMD41a9pBBG8opGmL2DbKk="]
End onProxyRes
[HPM] GET /api/core/businessAreas/user -> http://localhost:33678
Begin onProxyRes
www-authenticate "Negotiate oYG2MIGzoAMKAQChCwYJKoZIgvcSAQICooGeBIGbYIGYBgkqhkiG9xIBAgICAG+BiDCBhaADAgEFoQMCAQ+ieTB3oAMCARKicARuZWc6Q05giVBMb2rV72A3KNWiWB4G91zIkqqM5uaZz3gIe1VL1aWC0DdZu5HuS9ZnMvTnEv5hTeYWWD6ph0JryStHjZjak6mcBOVycnQWMJXh19d8cHYA0F9TcEvBy2a9xC6pmBdPC9amgnxuVzE="
www-authenticate ["Negotiate oYG2MIGzoAMKAQChCwYJKoZIgvcSAQICooGeBIGbYIGYBgkqhkiG9xIBAgICAG+BiDCBhaADAgEFoQMCAQ+ieTB3oAMCARKicARuZWc6Q05giVBMb2rV72A3KNWiWB4G91zIkqqM5uaZz3gIe1VL1aWC0DdZu5HuS9ZnMvTnEv5hTeYWWD6ph0JryStHjZjak6mcBOVycnQWMJXh19d8cHYA0F9TcEvBy2a9xC6pmBdPC9amgnxuVzE="]
End onProxyRes

[LukeDi]

Interesting, I'm not having much luck with IE. Same issue as Chrome.

[alan-agius4]

I am thinking this might be related to #14743 can you please check if adding crossorigin works?

[lacera-ep]

Having the same problem here.

[LukeDi]

How can I test #14743 locally? I cloned the repo and ran yarn/yarn link but when I run ng new I get:

C:\Temp\dev\angular-cli-master\angular-cli-master>ng new test
Cannot find module 'C:\Temp\dev\angular-cli-master\angular-cli-master\node_modul
es@schematics\angular\ng-new'

[fredjeck]

Please find attached a sample project to reproduce the issue (sorry couldnt create a repo from it due to weird corporate restrictions). GitHub14595.zip

The zip file contains the following elements

• A vanilla ASP Mvc web application with windows authentication enabled (you will need Visual Studio to run it, make sure you restore the nuget packages before running it). The app has a single method endpoint ("/Api/User") which retrieves and returns the currently logged in user.
• A vanilla angular 7 app which configured to proxy all the requests to /api to the Asp application (the npm startup script takes care of including the proxy config file).
• The same angular app migrated to angular 8.

Running the web app and the Angular 7 app is working fine, the credentials are proxied as expected. Running the web app and the Angular 8 app does not work and traps the user in an infinite credentials prompt loop.

Hope this helps

[raphaeel-m]

Same issue here. IE works fine while Chrome doesn't work.

[czielin]

@fredjeck were you able to find a work around for this using Angular 8?

[fredjeck]

@fredjeck were you able to find a work around for this using Angular 8?

Yes I found something, now instead of workaround I would better qualify it as a "ugly dirty fix"
As the issue is only bugging the team while developping (failure to proxy the credentials to the proxied API) I added a couple of #IF DEBUG statements in the code handling the user forcing the user to the one logged in (System.Security.Principal.WindowsIdentity.GetCurrent().Name) and disabling windows auth and restoring anonymous auth on the API side.

It is dirty but works. Impacts are limited to the development environment as the CI takes care of cleaning up everything for all of the others environments.

[czielin]

Thanks @fredjeck ! We were considering a similar ugly work around, but weren't sure how well it would work. We will probably now take a crack at implementing the same fix.

[Subodh-Wasankar]

Same Issue infinite credential prompts over chrome and firefox, works in IE. Got it worked with similar 'ugly work around' as suggested by @fredjeck.

[czielin]

For anyone else coming across this in need of a similar fix here's a snippet of what the work around we implemented looks like. Hope this helps save someone the significant time we lost on this.

public class AuthorizeAttribute : System.Web.Http.AuthorizeAttribute
{
protected override bool IsAuthorized(HttpActionContext actionContext)
{
#if DEBUG
actionContext.RequestContext.Principal = new GenericPrincipal(new GenericIdentity("domain\username"), new string[] { });
#endif