using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.Management;
using System.Text;

namespace MyProj_A
{
    public class MyHTTPModule : IHttpModule
    {

        void IHttpModule.Dispose()
        {
        }

        void IHttpModule.Init(HttpApplication context)
        {
            context.BeginRequest += Context_BeginRequest;
            context.AuthenticateRequest += OnEnter;
            context.EndRequest += OnLeave;
        }


        private void Context_BeginRequest(object sender, EventArgs e)
        {
            HttpContext context = HttpContext.Current;
            context.Response.Write("BeginRequest");
        }

        void OnEnter(object sender, EventArgs e)
        {
            HttpContext context = HttpContext.Current;
            if (IsHeaderPresent())
            {
                if (!AuthenticateUser())
                {
                    DenyAccess();
                }
            }
            else
            {
                // if anonymous requests are not allowed - end the request
                DenyAccess();
            }
        }

        bool IsHeaderPresent()
        {
            return HttpContext.Current.Request.Headers["Authorization"] != null;
        }

        bool AuthenticateUser()
        {
            string username = "", password = "";
            string authHeader = HttpContext.Current.Request.Headers["Authorization"];
            if (authHeader != null && authHeader.StartsWith("Basic"))
            {
                // extract credentials from header
                string[] credentials = ExtractCredentials(authHeader);
                username = credentials[0];
                password = credentials[1];
                if (username.CompareTo("tikskit") == 0 && password.CompareTo("") == 0)
                {
                    return true;
                } else
                {
                    return false;
                }
            }
            else
            {
                return false;
            }
        }


        private static void DenyAccess()
        {
            HttpContext context = HttpContext.Current;

            context.Response.StatusCode = 401;
            context.Response.End();
        }

        void OnLeave(object sender, EventArgs e)
        {
            // check if module is enabled
            if (HttpContext.Current.Response.StatusCode == 401)
            {
                SendAuthenticationHeader();
            }
        }

        private void SendAuthenticationHeader()
        {
            HttpContext context = HttpContext.Current;

            context.Response.StatusCode = 401;
            context.Response.AddHeader(
                "WWW-Authenticate",
                "Basic realm=\"yo-ho-ho\""
                );

        }
    }

}

<?xml version="1.0"?>
<configuration>

  <appSettings>
    <add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
  </appSettings>
  <system.web>
    <compilation debug="true" targetFramework="4.5.2" />
    <httpRuntime targetFramework="4.5.2"/>
    <customErrors mode="Off" />
  </system.web>


  <system.serviceModel>
    <behaviors>

      <endpointBehaviors>
        <behavior name="webBehavior">
          <webHttp automaticFormatSelectionEnabled="false"/>
        </behavior>
      </endpointBehaviors>

       <serviceBehaviors>
        <behavior name="Default" >
          <serviceMetadata httpGetEnabled="false" />
          <serviceMetadata httpsGetEnabled="false"/>
          <serviceAuthenticationManager authenticationSchemes="Basic"/>
          <serviceCredentials>
          </serviceCredentials>

        </behavior>
      </serviceBehaviors>

    </behaviors>

    <bindings>      
      <webHttpBinding>
        <binding name="MyBinding">
          <security mode="TransportCredentialOnly">
            <transport clientCredentialType="Basic"/>
          </security>
        </binding>
      </webHttpBinding>
    </bindings>

    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />

    <services>
      <service name="MyProj_A.Service1">
        <endpoint address="" binding="webHttpBinding" contract="MyProj_A.IService1"
                  behaviorConfiguration="webBehavior"/>
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost/" />
          </baseAddresses>
        </host>
      </service>
    </services>
    <diagnostics>
      <endToEndTracing activityTracing="false" messageFlowTracing="true" propagateActivity="true"></endToEndTracing>
    </diagnostics>
  </system.serviceModel>

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
      <add name="MyHTTPModule"
        type="MyProj_A.MyHTTPModule,MyProj-A"/>
    </modules>

    <directoryBrowse enabled="false"/>
  </system.webServer>

</configuration>

<endpoint address="" binding="webHttpBinding" contract="MyProj_A.IService1"
                  behaviorConfiguration="webBehavior"
                  bindingConfiguration="MyBinding"/>