I am trying to work with some legacy code and have come up against an issue when using volley.
I am trying to get to an api that our main site has and it works fine
Indeed, I have solved this problem by including the WWW-Authenticate header in the server response.
However, if you add the header WWW-Authenticate: Basic realm="" and your API is also consumed by web clients, some web browsers will trigger a pop up asking for basic credentials.
For me the right solution has been using a custom scheme. As explained in this blog post, I use xBasic instead of Basic in the header response.
WWW-Authenticate: xBasic realm=""
With this header, not only Volley parses the response correctly, but I also avoid web browsers showing the authentication pop up.