I am using the ArcGIS Javascript API to consume a feature layer on an ArcGIS Server secured with Windows Authentication. I want to satisfy the authentication programmatically so the web user isn't prompted with a login.

I've poked around the web and seen something about downloading an ASP.NET proxy page, but it is from the 9.3 section of the online ESRI resources. I'm just wondering if there is a different way to do it in 10.x versions?

3 Answers 3


A proxy page can also be used to bypass an authenticated service with 10.x versions of the APIs.

A few things to note:

  • Bypassing the Windows authentication with a proxy page will cause all of your connections to be made by the identity of the application pool that runs the proxy page, or by the identity of the connection you make within the proxy page. This may cause problems for tracking "who does what" since actions made through the proxy will all appear to be the same user.
  • Bypassing authentication may not be permitted by the publishing authority. Make sure you're allowed to publish the service in such a way before proceeding.
  • In the ESRI Javascript API, the proxy is set as a global setting, and all connections that would use a proxy will be directed through the same proxy page. So, if you're combining services in your map, make sure your proxy handler is ready to deal with whatever gets thrown at it approriately.

Windows Authentication is normally used on an internal network only, where you may take advantage of the integrated login, and bypass the login prompt that way. If your users are on the internal network, and have already logged on to the domain on their workstation, they shouldn't be challenged by a login prompt (IIS should already have handled that!)

Users that are not logged on to the network already, such as external users being directed to the Windows-secured server, will always be presented with a login prompt. There is no way to apply the login in the background once this prompt appears - its presence indicates that the background login attempt has already failed.

  • Thanks for the info. It sounds like using a proxy makes it hard to maintain a clean separation of concerns. Is there another way to accomplish Windows Auth in the background without a proxy page?
    – lintmouse
    Commented Oct 4, 2013 at 14:20
  • That's true. A proxy page is used to grant access to services that you would otherwise be unable to access. It's better to ensure that your clients would already have access to the resources with Windows security, if you can.
    – mwalker
    Commented Oct 4, 2013 at 18:18
  • I just noticed that when I consume an ESRI basemap, it also goes through my proxy (looks like you mentioned this in your third bullet point). It also looks like it makes a call to the proxy for every tile that is loaded. This is noticeably slower. Is there any way to avoid this behavior?
    – lintmouse
    Commented Oct 7, 2013 at 18:40
  • You can avoid this behavior by creating a custom proxy handler that only proxies requests to your one service. This is a full reverse proxy instead of a proxy page. You would add the service to your map by using servername/proxy/myproxy.ashx instead of its normal address, and leave the proxy configuration blank.
    – mwalker
    Commented Oct 7, 2013 at 19:04
  • 1
    Okay, thanks. I just found the esri.addProxyRule method (introduced in version 3.4 of the API) that allows you to set proxies on a per-layer basis and that appears to work quite well.
    – lintmouse
    Commented Oct 7, 2013 at 19:59

The proxy for JSAPI is built to access services that are secured with token-based authentication
This issue on the proxy's GitHub repo page highlights this limitation
"Java/.NET : Throw "Error 500-Protocol Error" when passing ArcGIS Server uri with windows authentication"
There's a discussion about making modification to the proxy to support Windows authentication. However, it seems it hasn't been made yet.

To work around this issue, you can use CORS (Cross Origin Resource Sharing) instead of using a proxy.
You need a browser and server that support CORS
These browsers support CORS
ArcGIS Server 10.1 supports CORS out of the box. Versions 9.3 and 10.0 do not have support for CORS but can be easily added by an administrator. enable-cors.org has detailed instructions on how to do this.

Read more on using CORS with JSAPI in this page


This is something that has to be handled by the browser itself, not JavaScript. See Integrated Windows Authentication and the browser-specific notes.

  • We don't have control over the browser settings of the clients, so this isn't very feasible for us. Is it possible to enable/disable authentication on a per-service basis on ArcGIS Server? I'd rather push for not using authentication on the service since it's going to be consumed in a map embedded in the public corporate website, which doesn't require authentication...
    – lintmouse
    Commented Oct 4, 2013 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.