"WinHttpException: The parameter is incorrect" when server return 401

[TingluoHuang]

I have a customized HttpMessageHandler that handle 401 from http response and throw a particular exception to provide better error message for end user. The code works fine with full desktop .net 4.5, however after ported to dotnet core i am getting the "WinHttpException: The parameter is incorrect" error when server return 401.
Here is the full call stack when 401 happen for both dotnet core app and .net 4.5 app:

dotnet core:
[2016-08-30 17:28:45Z ERR  Terminal] System.Net.Http.HttpRequestException: An error occurred while sending the request. ---> System.Net.Http.WinHttpException: The parameter is incorrect
   at System.Net.Http.WinHttpAuthHelper.SetWinHttpCredential(SafeWinHttpHandle requestHandle, ICredentials credentials, Uri uri, UInt32 authScheme, UInt32 authTarget)
   at System.Net.Http.WinHttpAuthHelper.CheckResponseForAuthentication(WinHttpRequestState state, UInt32& proxyAuthScheme, UInt32& serverAuthScheme)
   at System.Net.Http.WinHttpHandler.<StartRequest>d__101.MoveNext()
   --- End of inner exception stack trace ---
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.<SendAsync>d__3.MoveNext() in C:\VSO\src\Vssf\Client\Common\VssHttpRetryMessageHandler.cs:line 150
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Net.Http.HttpClient.<FinishSendAsync>d__58.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__45.MoveNext() in C:\VSO\src\Vssf\Client\WebApi\VssHttpClientBase.cs:line 762
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__42`1.MoveNext() in C:\VSO\src\Vssf\Client\WebApi\VssHttpClientBase.cs:line 663
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__27`1.MoveNext() in C:\VSO\src\Vssf\Client\WebApi\VssHttpClientBase.cs:line 383
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__26`1.MoveNext() in C:\VSO\src\Vssf\Client\WebApi\VssHttpClientBase.cs:line 366
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.ConfigurationManager.<GetPoolId>d__11.MoveNext() in C:\vsts-agent\src\Agent.Listener\Configuration\ConfigurationManager.cs:line 461
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at Microsoft.VisualStudio.Services.Agent.Listener.Configuration.ConfigurationManager.<ConfigureAsync>d__7.MoveNext() in C:\vsts-agent\src\Agent.Listener\Configuration\ConfigurationManager.cs:line 152

.net 4.5:
Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: VS30063: You are not authorized to access https://ting.tfsbuildhost8.tfsallin.net.
   at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.<SendAsync>d__17.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.<SendAsync>d__3.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__45.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__42`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__27`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.<SendAsync>d__26`1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at Microsoft.VisualStudio.Services.WebApi.TaskExtensions.SyncResult[T](Task`1 task)
   at ConsoleApplication9.Program.Main(String[] args) in C:\Users\tihuang\Documents\Visual Studio 2015\Projects\ConsoleApplication9\ConsoleApplication9\Program.cs:line 105

The Fiddler trace for both cases:

dotnet core:
GET https://ting.tfsbuildhost8.tfsallin.net/_apis/distributedtask/pools?poolName=default HTTP/1.1
Connection: Keep-Alive
Accept: application/json; api-version=3.0-preview.1
Accept-Encoding: gzip, peerdist
Accept-Language: en-US
Authorization: Basic VnN0c0FnZW50OmxscGQzb2djY2twdnJyNHh6NGtmeXpjeGdjN252cTNpYWVucHpqeXk0ZXk3emlqeXVmcmE=
User-Agent: VSServices/15.255.65000.0 (NetStandard) VstsAgentCore-win7-x64/2.106.0 (Microsoft Windows 10.0.14393)
X-TFS-FedAuthRedirect: Suppress
X-TFS-Session: 43b8fed2-d9d7-4582-9c91-6538cdd26e79
X-P2P-PeerDist: Version=1.1
X-P2P-PeerDistEx: MinContentInformation=1.0, MaxContentInformation=2.0
Host: ting.tfsbuildhost8.tfsallin.net

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/8.5
X-TFS-ProcessId: a3f879d3-c2d2-4c93-a872-671dd4b52407
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: OPTIONS,GET,POST,PATCH,PUT,DELETE
Access-Control-Expose-Headers: ActivityId,X-TFS-Session,X-MS-ContinuationToken
Access-Control-Allow-Headers: authorization
X-FRAME-OPTIONS: SAMEORIGIN
WWW-Authenticate: Basic realm="https://app.tfsbuildhost8.tfsallin.net/"
X-Powered-By: ASP.NET
P3P: CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOC CNT"
X-Content-Type-Options: nosniff
Date: Tue, 30 Aug 2016 17:17:37 GMT
Content-Length: 0

.net 4.5:
GET https://ting.tfsbuildhost8.tfsallin.net/_apis/distributedtask/pools HTTP/1.1
Accept: application/json; api-version=3.0-preview.1
User-Agent: VSServices/15.104.25627.0 (ConsoleApplication9.exe)
Accept-Language: en-US
X-TFS-FedAuthRedirect: Suppress
X-TFS-Session: 7b7a5d6a-e30f-4511-bf16-6396c91317b2
X-VSS-Agent: VSS: fe82a6ab-72ed-4ce2-8e28-d626d07f5d24
Authorization: Basic VnN0c0FnZW50OmxscGQzb2djY2twdnJyNHh6NGtmeXpjeGdjN252cTNpYWVucHpqeXk0ZXk3emlqeXVmcmE=
Host: ting.tfsbuildhost8.tfsallin.net
Accept-Encoding: gzip

HTTP/1.1 401 Unauthorized
Server: Microsoft-IIS/8.5
X-TFS-ProcessId: a3f879d3-c2d2-4c93-a872-671dd4b52407
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 3600
Access-Control-Allow-Methods: OPTIONS,GET,POST,PATCH,PUT,DELETE
Access-Control-Expose-Headers: ActivityId,X-TFS-Session,X-MS-ContinuationToken
Access-Control-Allow-Headers: authorization
X-FRAME-OPTIONS: SAMEORIGIN
WWW-Authenticate: Basic realm="https://app.tfsbuildhost8.tfsallin.net/"
X-Powered-By: ASP.NET
P3P: CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOC CNT"
X-Content-Type-Options: nosniff
Date: Tue, 30 Aug 2016 17:17:11 GMT
Content-Length: 0

Also, the "WinHttpException: The parameter is incorrect" doesn't tell me which parameter is incorrect which cause the exception message a little bit useless.
I can provide repro environment if needed.

[davidsh]

I have a customized HttpMessageHandler that handle 401 from http response and throw a particular exception to provide better error message for end user.

Can you share this code? We need more information about the repro for this. Thx.

[TingluoHuang]

@davidsh
You can find the code in //index
search for VssHttpMessageHandler.cs and line 308

throw new VssUnauthorizedException(message);

this is where we captcher 401 and throw a strong type exception. i don't have corpnet access, i can provide more detail information tomorrow.

[davidsh]

This is likely a dupe of either #17508 or #17545.

[droyad]

I have run across this as well, however in my case (and the one above I believe) the server only returns no or only a single WWW-Authenticate header:

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Expires: Thu, 01 Sep 2016 11:41:16 GMT
Server: Octopus Deploy/ Microsoft-HTTPAPI/2.0
X-UA-Compatible: IE=edge
X-Frame-Options: DENY
Date: Fri, 02 Sep 2016 11:41:16 GMT

HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Length: 16
Content-Type: text/plain; charset=utf-8
Server: Microsoft-IIS/8.0
WWW-Authenticate: Basic realm="Fake Realm"
X-AspNetMvc-Version: 5.1
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Access-Control-Allow-Origin: *
Date: Fri, 02 Sep 2016 11:22:18 GMT

The error only occurs if CredentialCache.DefaultNetworkCredentials or CredentialCache.DefaultCredentials` is used. Custom credentials are fine.

The code to reproduce:

public static void Main(string[] args)
{
    MainAsync(args).GetAwaiter().GetResult();
    Console.WriteLine("Done");
    Console.ReadKey();
}

public static async Task MainAsync(string[] args)
{
    var handler = new HttpClientHandler()
    {
        Credentials = CredentialCache.DefaultNetworkCredentials,
        UseProxy = false,
        AllowAutoRedirect = true // false also produces the error
    };

    using (var client = new HttpClient(handler))
        await client.GetAsync("http://httpstat.us/401");
}

[davidsh]

The error only occurs if CredentialCache.DefaultNetworkCredentials or CredentialCache.DefaultCredentials` is used. Custom credentials are fine.

This is interesting. Keep in mind that default credentials don't work at all when used with Basic. Default credentials can only be transmitted via Negotiate or NTLM schemes.

[davidsh]

I have repro'd the bug.

Basically, this exception is happening if a server asks for Basic authentication and the HttpClientHandler.Credentials is set to default credentials. In this combination, WinHttpHandler needs to behave as-if no credentials are set because it is not possible to transmit default creds over Basic.

[droyad]

Awesome! That means that the following is a workaround:

public static async Task Do(NetworkCredential creds)
{
    var handler = new HttpClientHandler()
    {
        Credentials = new CredentialWrapper(creds),
        UseProxy = false,
        AllowAutoRedirect = true // false also produces the error
    };

    using (var client = new HttpClient(handler))
        await client.GetAsync("http://httpstat.us/401");
}

private class CredentialWrapper : ICredentials
{
    private readonly NetworkCredential _creds;

    public CredentialWrapper(NetworkCredential creds)
    {
        _creds = creds;

    }

    public NetworkCredential GetCredential(Uri uri, string authType)
        => authType == "Basic" && _creds == CredentialCache.DefaultNetworkCredentials // Digest as well?
            ? null
            : _creds.GetCredential(uri, authType);
}

[droyad]

@davidsh I tried a build of those changes, and it does not fix my scenario, when there is no WWW-Authenticate header at all.

I stepped through it and the error occurs here https://github.com/dotnet/corefx/blob/master/src/System.Net.Http.WinHttpHandler/src/System/Net/Http/WinHttpAuthHelper.cs#L90 calling the interop code

I can't get the test project to build, so no failing unit test :/, but if you use https://demo.octopusdeploy.com/api/users/me as the url in the above repro code, that will cause the problem.

It does however fix the scenario where there is one header, so thank you.

[droyad]

Then again, the server does not meet https://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.2

[droyad]

The same error also occurs if the WWW-Authenticate header returns a realm that it does not recognise, which is allowed by the RFC.

[davidsh]

Doing a GET request to this endpoint:

https://demo.octopusdeploy.com/api/users/me

Returns the following. And as you noted, the HTTP response violates the RFC because a 401 response MUST include a www-authenticate header:

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Expires: Sun, 04 Sep 2016 21:03:21 GMT
Server: Octopus Deploy/ Microsoft-HTTPAPI/2.0
X-UA-Compatible: IE=edge
X-Frame-Options: DENY
Date: Mon, 05 Sep 2016 21:03:20 GMT

77
{
  "ErrorMessage": "You must be logged in to perform this action. Please provide a valid API key or log in again."
}
0

As per the RFC:

10.4.2 401 Unauthorized
The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.47) containing a challenge applicable to the requested resource.
...

If you wish us to consider allowing such a non-standard response such as this without throwing an error (i.e. just return the 401 response as-is), please open a new issue. Thx.