Is Application_AuthenticateRequest always before Session_Start?

Question

Does Application_AuthenticateRequest always fire before Session_Start in global.asax? I'm trying to find some authoritative documentation regarding it.

I assume it does, and researching it suggests it does. But I've not found an authoritative answer (unless I'm missing something).

My normal resource for the asp.net application lifecycle is nicely detailed, but doesn't really go into detail how some of modules' events are ordered.

Does anyone know of some authoritative documentation that details examples of how some of the built in modules events are ordered (particularly the SessionStateModule)?

I've hunted around, but not found anything yet.

See https://stackoverflow.com/questions/441421/httpmodule-event-execution-order/441460#441460 — Michael Freidgeim, Apr 02 '21 at 05:05

score 8 · Accepted Answer · answered Jan 23 '13 at 16:43

I haven't seen any official documentation, but looking at the SessionStateModule in Reflector shows that the Start event is raised by the RaiseOnStart method, which is called from the CompleteAcquireState method, which is called from the BeginAcquireState method, which handles the AcquireRequestState event.

According to the application lifecycle page, the AcquireRequestState event is always raised after the AuthenticateRequest, AuthorizeRequest, ResolveRequestCache and PostMapRequestHandler events.

NB: This is for .NET 4.0, but I believe the same is true for previous versions as well.

Goodol' Reflector! Thanks Richard for spending the time digging into the code. — Alex KeySmith, Jan 23 '13 at 16:51

Is Application_AuthenticateRequest always before Session_Start?

1 Answers1