I'm trying to create a drop-in dll that will run as a module on an existing application with just one web.config change. However, it is necessary to maintain state within the module. I don't think that I'm using the events correctly. Can I only manipulate session between AcquireState and ReleaseState events? Does that mean in BeginRequest or EndRequest, the session is off limits? I keep getting "not a reference," and, well, that seems to corroborate my theory. Can I RewritePath and intercept status codes elsewhere in the chain, like PreRequest and PostRequest (hopefully)? Or are there restrictions? If so, can I roll my own session using BeginRequest and EndRequest? Is there a better way to handle the desire to RewritePaths based on session? Thanks, -dt