---
title: BrowserAuthenticator
summary: API reference for BrowserAuthenticator.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.SecurityModule
reference_type: package
---

# BrowserAuthenticator

`BrowserAuthenticator` issues an HTTP 401 response carrying `WWW-Authenticate` headers to trigger a native browser NTLM/Basic credential prompt. It is the fallback used by `InternalUserAuthenticator` when cookie-based authentication fails for an internal-host request.

## Purpose
- Force a browser-native Windows credential challenge for internal hosts when the silent cookie-authentication path is unavailable or fails.

## Context
- Namespace: `SAIF.Framework.SecurityModule`
- Assembly/package: `SAIF.Framework.SecurityModule` (packaged inside the `SAIF.BOF.Framework` NuGet package)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `Authenticate` | `Public Shared Sub Authenticate(response As HttpResponse, authType As String)` | Clears the response, sets HTTP status `401 Not Authorized`, and appends `WWW-Authenticate` headers for `authType` (defaulting to `NTLM`) and `Basic realm="SAIF"`. |

## Behavioral notes
- If `authType` is `Nothing`, the method falls back to `"NTLM"` for the primary `WWW-Authenticate` header value.
- A second, fixed `WWW-Authenticate: Basic realm="SAIF"` header is always appended in addition to the configured/default type, offering the browser both an NTLM and a Basic authentication option.
- `response.BufferOutput = True` is set before clearing the response, ensuring the 401 status and headers are not flushed prematurely.

## Constraints and usage notes
- The single public member is `Shared`; the class is not intended to be instantiated.
- Callers are responsible for invoking this only when cookie authentication has already failed (see the [operations and processes](../../operations-processes.md#browser-ntlmbasic-challenge) page for the calling flow).

## Sources
- `SAIF.Framework.SecurityModule\Authenticators\BrowserAuthenticator.vb`