如何停止 TFS 2008 的 401 响应
每当 Visual Studio 向 TFS 发出 Web 请求时，Fiddler 都会显示 401 未经授权错误。 然后，Visual Studio 将使用正确的授权协商标头再次尝试，TFS 将使用正确的数据和 200 状态代码进行响应。
如何才能在第一次发送正确的标头来阻止 401？
Whenever a web request is made by Visual Studio to TFS, Fiddler will show a 401 Unauthorized error. Visual Studio will then try again with a proper Authorization Negotiate header in place with which TFS will respond with the proper data and a 200 status code.
How can I get the correct headers to be sent the first time to stop the 401?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这就是 Windows 集成身份验证 (NTLM) 过程的工作原理。 NTLM 是一种基于连接的身份验证机制，实际上涉及 3 个调用来建立经过身份验证的会话。
然后，TFS API 会竭尽全力确保以最有效的方式完成此握手。 它将使经过身份验证的连接保持打开状态一段时间，以尽可能避免这种握手。 它还会使用内容最少的 HTTP 负载进行初始身份验证，然后如果您要发送的消息超过一定长度，则发送真实消息。 它还使用了许多其他技巧来优化与 TFS 的连接。
基本上，我不会管它，因为它运作良好。
This is how the process of Windows Integrated Authentication (NTLM) works. NTLM is a connection based authentication mechanism and actually involves 3 calls to establish the authenticated session.
The TFS API then goes to extra-ordinary lengths to make sure that this handshake is done in the most efficient way possible. It will keep the authenticated connection open for a period of time to avoid this hand-shake where possible. It will also do the initial authentication using a HTTP payload with minimal content and then send the real message if the message you were going to send is over a certain length. It does a bunch of other tricks as well to optimise the connection to TFS.
Basically, I would just leave it alone as it works well.
您将看到网络浏览器在与网站通信时也会执行此操作。 它总是会在第一次调用时尝试泄露最少的细节。 如果失败，它会透露更多关于你的信息。
这是设计使然，并且有一个很好的理由。
You will see that a web browser also does this when communicating with a web site. It will always try to give away the minimum amount of detail with the first call. If this fails, it will reveal a little more about you.
This is by design and for a very good reason.
这就是它总是这样做的方式 - 请求，获取 401 返回，然后发送授权。 它是 http 身份验证协议的一部分。
This is how it's always done - request, get the 401 back, then send the authorization. It's part of the authentication protocol for http.