Here are a few things to check.
1) What does the source url look like?
2) Confirm that the UserInfo property is working (which Microsoft says it does, and my tests show that it also does).
Response.Write("Raw: " + Request.RawUrl); Response.Write("<br />"); Uri uriAddress = new Uri("http://user: password@www.contoso.com /index.htm "); Response.Write("Test URL Results: "+uriAddress.UserInfo);
Based on my own tests, I would suggest that part of the user: the password is deleted before it gets to your page. In IE, as others claimed, I could not get it to accept values. In Chrome, it also seemed to automatically turn them off (after I typed the address and hit the values from the address bar right away).
Peter source share