We have an Umbraco instance that we're hosting in Azure. We've enabled Basic Auth as described here.

What we're experiencing:

• All requests from the whitelisted IP are allowed - regardless of the shared secret specified. The request header can be omitted or wrong, and the request is still successful
• All requests from non-whitelisted IPs are unsuccessful - regardless of the shared secret (this is expected)

My expectation is that both the conditions should be met before requests are allowed.

i.e The IP needs to be allowed AND the shared secret specified in the header needs to match the configured value.

We're exposing only a single endpoint (for integration) this way, all our other endpoints require Backoffice / Member Auth, but we don't want that for our integration endpoint.

Any idea why this is not working, and any suggestions are appreciated