AuthenticateRequest vs PostAuthenticateRequest + Session

Question

we're having a problem using the AuthenticateRequest for a Custom-Control: For persisting informations we're using the HttpContext.Current.Application.

For various Reasons, this is not working so proper, if multiple users are working in the same time, since the application key is not conclusively.

The problem: The persisting happens in the AuthenticateRequest-event, where the Session can't be accessed as far as I know. I searched a bit and found the PostAuthenticateRequest-event and the description about the difference here: http://leastprivilege.com/2006/07/02/authenticaterequest-vs-postauthenticaterequest/

Sadly, I still can't access the Session, HttpApplication throws a error:

{"Session state is not available in this context."}

And HttpApplication.Context.Session keeps getting NULL.

Is there anyhow a possibility to get the Session at this Point? Or is there another Event I could use, which would serve the same purpose?

Thanks in advance.

Matthias

Edith: I found out that the Header is lost between MapRequestHandler (Header set) and PostMapRequestHandler (Header not set)

Answer 1

Your problem is that PostAuthenticateRequest occurs earlier in the pipeline, that is before AcquireRequestState is called. In order to access session state you need that event to execute and should look towards events later in the lifecycle. If you a re not familiar with the event sequence have a look here...