IE8 is not automatically providing the header “Authorization” for an URL which is not a subdirectory of a an URL it has already been challenged for.
This triggers a certain error in our webapp.
Is there a workaround for this?
In other words: is there a way to make IE send the authorization header for parent directories, too?
It seems the answer to this is “you can’t”. There are RFCs that specify authorization behaviour, and a browser usually won’t send auth. headers for paths it hasn’t been challenged for (if they aren’t sub-paths).
I’m not aware of any API or such to modify this, so you can only do this with http code libs.