Q: IPSecurity Localhost Working From HttpClient Request I have a web application and a web API application.  Both .net 4.5.  I have IpSecurity set on the web api application. Both are hosted on the same machine in IIS.  The IP of the machine is 10.40.x.x.  So either entry below should work. 
<security>
   <ipSecurity allowUnlisted="false">        
   <clear />
    <add ipAddress="10.0.0.0" subnetMask="255.0.0.0" allowed="true" />
    <add ipAddress="127.0.0.1" subnetMask="255.255.255.255" allowed="true"/> 
  </ipSecurity>

The applicationHost.config is set:   
      <section name="ipSecurity" overrideModeDefault="Allow" />

From a browser I can access the homepage for the web api application from localhost.  This works fine.  When I make a HttpClient GET request to the web api application from the Web Application, I get a 403.6 forbidden response indicating that IIS has blocked the request due to IP Security.
I can make direct Web API calls to the web API application from localhost using POSTMan, or any other method. The only time it serves up 403.6 forbidden is when making a request to the same URL from HttpClient within  my web app.
If I change    
<ipSecurity allowUnlisted="true"> 

Requests from the web app work.  So it's definitely something with IIS IP restrictions and not something else.
Why would requests from a web app in an HttpClient be blocked, but others in a different context not be blocked?  
