Invoke was incrementing the IP failure counter whenever any Authorization header was present but unparseable as Basic credentials — including Bearer tokens and other schemes — unintentionally triggering lockouts for clients not attempting Basic Auth at all.

Changes

• TryGetCredentials: Removed hadAuthorizationHeader out parameter — it was the only driver of the incorrect failure path
• Invoke: Removed the if (hadAuthorizationHeader) { RegisterFailedAttempt(...) } block; failed attempts now register only when credentials fully parse (valid Basic scheme, decodable base64, extractable user:pass) but are rejected by IsAuthorized

Before: Authorization: ******  →  RegisterFailedAttempt (wrong)
After:  Authorization: ******  →  401 challenge, no counter increment

Before: Authorization: Basic <garbage_b64>  →  RegisterFailedAttempt (wrong)
After:  Authorization: Basic <garbage_b64>  →  401 challenge, no counter increment

Before/After: Authorization: Basic <valid_b64_wrong_creds>  →  RegisterFailedAttempt (correct)

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.