PostAuthenticateRequest called on no user

Discussion in 'ASP .Net Security' started by David Thielen, Nov 9, 2006.

  1. Hi;

    I have a situation where I go to access my app running on IIS on Win2003. In
    Global.asax I have Application_PostAuthenticateRequest and that is called
    when HttpContext.Current.User is null.

    Subsequent to that I get prompted to enter my uname/password by IE so it
    does make sense that there is no CurrentUser yet. My question is, how can
    Application_PostAuthenticateRequest be called if there is no authenticated
    user yet?

    --
    thanks - dave
    david_at_windward_dot_net
    http://www.windwardreports.com

    Cubicle Wars - http://www.windwardreports.com/film.htm
    David Thielen, Nov 9, 2006
    #1
    1. Advertising

  2. we are talking about a pipeline. This event is called on every request.

    If you code should only run when there is an authenticated user - do

    if (Request.IsAuthenticated)
    {}

    ---
    Dominick Baier, DevelopMentor
    http://www.leastprivilege.com

    > Hi;
    >
    > I have a situation where I go to access my app running on IIS on
    > Win2003. In Global.asax I have Application_PostAuthenticateRequest and
    > that is called when HttpContext.Current.User is null.
    >
    > Subsequent to that I get prompted to enter my uname/password by IE so
    > it does make sense that there is no CurrentUser yet. My question is,
    > how can Application_PostAuthenticateRequest be called if there is no
    > authenticated user yet?
    >
    > Cubicle Wars - http://www.windwardreports.com/film.htm
    >
    Dominick Baier, Nov 9, 2006
    #2
    1. Advertising

  3. I thought if it was authenticated the pipeline was ended and all that was
    called was EndRequest???

    --
    thanks - dave
    david_at_windward_dot_net
    http://www.windwardreports.com

    Cubicle Wars - http://www.windwardreports.com/film.htm




    "Dominick Baier" wrote:

    > we are talking about a pipeline. This event is called on every request.
    >
    > If you code should only run when there is an authenticated user - do
    >
    > if (Request.IsAuthenticated)
    > {}
    >
    > ---
    > Dominick Baier, DevelopMentor
    > http://www.leastprivilege.com
    >
    > > Hi;
    > >
    > > I have a situation where I go to access my app running on IIS on
    > > Win2003. In Global.asax I have Application_PostAuthenticateRequest and
    > > that is called when HttpContext.Current.User is null.
    > >
    > > Subsequent to that I get prompted to enter my uname/password by IE so
    > > it does make sense that there is no CurrentUser yet. My question is,
    > > how can Application_PostAuthenticateRequest be called if there is no
    > > authenticated user yet?
    > >
    > > Cubicle Wars - http://www.windwardreports.com/film.htm
    > >

    >
    >
    >
    David Thielen, Nov 9, 2006
    #3
  4. nope.

    there is a bunch of stuff going on after authentication - e.g. role management,
    caching etc...

    all events are called every time (besides when you are not authorized - then
    the request is ended in AuthorizeRequest)

    ---
    Dominick Baier, DevelopMentor
    http://www.leastprivilege.com

    > I thought if it was authenticated the pipeline was ended and all that
    > was called was EndRequest???
    >
    > Cubicle Wars - http://www.windwardreports.com/film.htm
    >
    > "Dominick Baier" wrote:
    >
    >> we are talking about a pipeline. This event is called on every
    >> request.
    >>
    >> If you code should only run when there is an authenticated user - do
    >>
    >> if (Request.IsAuthenticated)
    >> {}
    >> ---
    >> Dominick Baier, DevelopMentor
    >> http://www.leastprivilege.com
    >>> Hi;
    >>>
    >>> I have a situation where I go to access my app running on IIS on
    >>> Win2003. In Global.asax I have Application_PostAuthenticateRequest
    >>> and that is called when HttpContext.Current.User is null.
    >>>
    >>> Subsequent to that I get prompted to enter my uname/password by IE
    >>> so it does make sense that there is no CurrentUser yet. My question
    >>> is, how can Application_PostAuthenticateRequest be called if there
    >>> is no authenticated user yet?
    >>>
    >>> Cubicle Wars - http://www.windwardreports.com/film.htm
    >>>
    Dominick Baier, Nov 9, 2006
    #4
  5. Oh right - if an authenticed user is ok then it must keep going. And it's
    AuthorizeRequest that needs to end it.

    --
    thanks - dave
    david_at_windward_dot_net
    http://www.windwardreports.com

    Cubicle Wars - http://www.windwardreports.com/film.htm




    "Dominick Baier" wrote:

    > nope.
    >
    > there is a bunch of stuff going on after authentication - e.g. role management,
    > caching etc...
    >
    > all events are called every time (besides when you are not authorized - then
    > the request is ended in AuthorizeRequest)
    >
    > ---
    > Dominick Baier, DevelopMentor
    > http://www.leastprivilege.com
    >
    > > I thought if it was authenticated the pipeline was ended and all that
    > > was called was EndRequest???
    > >
    > > Cubicle Wars - http://www.windwardreports.com/film.htm
    > >
    > > "Dominick Baier" wrote:
    > >
    > >> we are talking about a pipeline. This event is called on every
    > >> request.
    > >>
    > >> If you code should only run when there is an authenticated user - do
    > >>
    > >> if (Request.IsAuthenticated)
    > >> {}
    > >> ---
    > >> Dominick Baier, DevelopMentor
    > >> http://www.leastprivilege.com
    > >>> Hi;
    > >>>
    > >>> I have a situation where I go to access my app running on IIS on
    > >>> Win2003. In Global.asax I have Application_PostAuthenticateRequest
    > >>> and that is called when HttpContext.Current.User is null.
    > >>>
    > >>> Subsequent to that I get prompted to enter my uname/password by IE
    > >>> so it does make sense that there is no CurrentUser yet. My question
    > >>> is, how can Application_PostAuthenticateRequest be called if there
    > >>> is no authenticated user yet?
    > >>>
    > >>> Cubicle Wars - http://www.windwardreports.com/film.htm
    > >>>

    >
    >
    >
    David Thielen, Nov 9, 2006
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Apricot
    Replies:
    4
    Views:
    514
    velthuijsen
    Apr 16, 2004
  2. Weng Tianxiang
    Replies:
    6
    Views:
    583
    glen herrmannsfeldt
    Sep 12, 2007
  3. S_K
    Replies:
    6
    Views:
    1,165
    Robert Dunlop
    Nov 8, 2007
  4. Jimmy Hartzell
    Replies:
    0
    Views:
    411
    Jimmy Hartzell
    May 19, 2008
  5. Jimmy Hartzell
    Replies:
    2
    Views:
    1,162
    Jimmy Hartzell
    May 20, 2008
Loading...

Share This Page