I have a web application (hosted in IIS) that talks to a Windows service. The Windows service is using the ASP.Net MVC Web API (self-hosted), and so can be communicated with over http using JSON. The web application is configured to do impersonation, the idea being that the user who makes the request to the web application should be the user that the web application uses to make the request to the service. The structure looks like this:

![][1]

&lt;sub&gt;(The user highlighted in red is the user being referred to in the examples below.)&lt;/sub&gt;

----

The web application makes requests to the Windows service using an [`HttpClient`][2]:

    var httpClient = new HttpClient(new HttpClientHandler() 
                          {
                              UseDefaultCredentials = true
                          });
    httpClient.GetStringAsync(&quot;http://localhost/some/endpoint/&quot;);

This makes the request to the Windows service, but does not pass the credentials over correctly (the service reports the user as `IIS APPPOOL\ASP.NET 4.0`). **This is not what I want to happen**.

If I change the above code to use a [`WebClient`][3] instead, the credentials of the user are passed correctly:

    WebClient c = new WebClient
                       {
                           UseDefaultCredentials = true
                       };
    c.DownloadStringAsync(new Uri(&quot;http://localhost/some/endpoint/&quot;));

With the above code, the service reports the user as the user who made the request to the web application.

**What am I doing wrong with the `HttpClient` implementation that is causing it to not pass the credentials correctly** (or is it a bug with the `HttpClient`)?

&lt;sub&gt;The reason I want to use the `HttpClient` is that it has an async API that works well with `Task`s, whereas the `WebClient`&#39;s asyc API needs to be handled with events.&lt;/sub&gt;

  [1]: http://i.stack.imgur.com/EQonG.png
  [2]: http://msdn.microsoft.com/en-us/library/system.net.http.httpclient.aspx
  [3]: http://msdn.microsoft.com/en-us/library/system.net.webclient%28v=vs.100%29.aspx

All Windows Security Solutions on Gang of Coders

Total of 1 Windows Security Solutions

How to get HttpClient to pass credentials along with the request?