Fixed HTTP Basic authentication for OAuth 2 clients so that it actually works in the sample.

3 files changed, 20 insertions, 0 deletions

diff --git a/src/DotNetOpenAuth.Core/Messaging/Channel.cs b/src/DotNetOpenAuth.Core/Messaging/Channel.cs
index fbcb3d6..235c41b 100644
--- a/src/DotNetOpenAuth.Core/Messaging/Channel.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/Channel.cs
@@ -1097,6 +1097,7 @@ namespace DotNetOpenAuth.Messaging {
 			UriBuilder builder = new UriBuilder(requestMessage.Recipient);
 			MessagingUtilities.AppendQueryArgs(builder, fields);
 			HttpWebRequest httpRequest = (HttpWebRequest)WebRequest.Create(builder.Uri);
+			this.PrepareHttpWebRequest(httpRequest);
 
 			return httpRequest;
 		}
@@ -1137,6 +1138,7 @@ namespace DotNetOpenAuth.Messaging {
 			var fields = messageAccessor.Serialize();
 
 			var httpRequest = (HttpWebRequest)WebRequest.Create(requestMessage.Recipient);
+			this.PrepareHttpWebRequest(httpRequest);
 			httpRequest.CachePolicy = this.CachePolicy;
 			httpRequest.Method = "POST";
 
@@ -1314,6 +1316,14 @@ namespace DotNetOpenAuth.Messaging {
 		}
 
 		/// <summary>
+		/// Performs additional processing on an outgoing web request before it is sent to the remote server.
+		/// </summary>
+		/// <param name="request">The request.</param>
+		protected virtual void PrepareHttpWebRequest(HttpWebRequest request) {
+			Requires.NotNull(request, "request");
+		}
+
+		/// <summary>
 		/// Customizes the binding element order for outgoing and incoming messages.
 		/// </summary>
 		/// <param name="outgoingOrder">The outgoing order.</param>
diff --git a/src/DotNetOpenAuth.Core/Messaging/HttpRequestHeaders.cs b/src/DotNetOpenAuth.Core/Messaging/HttpRequestHeaders.cs
index 9579a81..dad6bf6 100644
--- a/src/DotNetOpenAuth.Core/Messaging/HttpRequestHeaders.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/HttpRequestHeaders.cs
@@ -20,6 +20,11 @@ namespace DotNetOpenAuth.Messaging {
 		internal const string Authorization = "Authorization";
 
 		/// <summary>
+		/// The WWW-Authenticate header, which is included in HTTP 401 Unauthorized responses to help the client know which authorization schemes are supported.
+		/// </summary>
+		internal const string WwwAuthenticate = "WWW-Authenticate";
+
+		/// <summary>
 		/// The Content-Type header, which specifies the MIME type of the accompanying body data.
 		/// </summary>
 		internal const string ContentType = "Content-Type";
diff --git a/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs b/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs
index a5fe782..7691cc4 100644
--- a/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs
+++ b/src/DotNetOpenAuth.Core/Messaging/OutgoingWebResponseActionResult.cs
@@ -35,6 +35,11 @@ namespace DotNetOpenAuth.Messaging {
 		/// <param name="context">The context in which to set the response.</param>
 		public override void ExecuteResult(ControllerContext context) {
 			this.response.Respond(context.HttpContext);
+
+			// MVC likes to muck with our response.  For example, when returning contrived 401 Unauthorized responses
+			// MVC will rewrite our response and turn it into a redirect, which breaks OAuth 2 authorization server token endpoints.
+			// It turns out we can prevent this unwanted behavior by flushing the response before returning from this method.
+			context.HttpContext.Response.Flush();
 		}
 	}
 }