By default the XmlReader uses an XmlUrlResolver object with no user credentials to open resources. This means that, by default, the XmlReader can access any locations that do not require credentials. You can use one of the following methods to control which resources the XmlReader can access:
Do not allow the XmlReader to open any external resources by setting the XmlResolver property to null.
In synchronous mode, the Create method will read the first chunk of data from the buffer of the File, Stream, or Text reader, which may throw an exception if an IO operation fails. In asynchronous mode, the first IO operation occurs with a read operation, so exceptions that arise will be throw when the read operation occurs.
// Create a resolver with default credentials.
XmlUrlResolver resolver = new XmlUrlResolver();
resolver.Credentials = System.Net.CredentialCache.DefaultCredentials;
// Set the reader settings object to use the resolver.
settings.XmlResolver = resolver;
// Create the XmlReader object.
XmlReader reader = XmlReader.Create("http://ServerName/data/books.xml", settings);