Why does authenticateRequest light up on the page when the user logs out?
My goal is to write a cookie when the user authenticates. We use a crappy framework that hides the source code and event model, so when I use my login control I can't set a session timeout for it!
Anyway, I'm trying to write a cookie when the user is logged in and then update the cookie expiration time on subsequent page views (faster transition).
So, I figured I could create a cookie first during Application_AuthenticateRequest in global.asax, but it looks like it fires even when the user hasn't signed up yet.
Is that so?
Yes. Application_AuthenticateRequest will fire every time a request hits the website. AuthenticateRequest as well as authentication will also check and return if authorization occurs for the page. Some pages should be excluded from authentication and authorization, such as the login page.
For your situation, you should also check the page and exclude those involved in the login sequence.
a source to share
The Application_AuthenticateRequest app runs on every request, but if you are using forms authentication and the user is not logged in yet, you will find that the User property of the HttpContext (accessible via this.User in the app's global file) evaluates to null while it evaluates the object IPrincipal if the user is logged in.
So, you can do something like this:
Private Sub Application_AuthenticateRequest(ByVal pObjSender As Object, ByVal pEaDummy As EventArgs)
If Me.User IsNot Nothing AndAlso Me.User.Identity.IsAuthenticated Then
If Me.Request.Cookies("authCookieName") Is Nothing Then
' Create cookie
Else
' Update cookie
End If
End If
End Sub
where authCookieName is the name of the cookie.
a source to share