Fix IE8 unable to authenticate on a local website using Windows authentication

Symptom

IE8 refuses to authenticate on a local website (website and browser are on the same machine) even when valid credentials are supplied, when the website is reached using a host header bound to the machine's loopback address. After a few attempts, the website reports an HTTP 401.1 Access Denied error. A different browser may authenticate successfully. Browsing the website with IE8 from an external client computer authenticates as expected.

Cure

A Windows security update is responsible for a loopback check security feature that is meant to prevent reflection attacks. Authentication fails if the host header does not match the local computer name. Disable the loopback check in the registry:

1. Run regedit.
2. Find HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa.
3. Add a new DWORD value called DisableLoopbackCheck.
4. Modify the new value data to 1.
5. Reboot.

Related

• More info at Microsoft KB article 896861: http://support.microsoft.com/kb/896861.