I have a .net 4.7.2 web api deployed on IIS with Windows authentication.

When I open it, if I valid authentication form with empty user and password, it works, swagger page is displayed and API call with swagger works to :

My controller Home :

If I spy "HttpContext.User.Identity", it filled with my credentials :

I test the same scenario with a static website, same result.

Is it normal ?

Thank you for your help