Where is FormsAuthenticationModule registered?

Question

Now I'm trying to find out how asp.net mvc authentication works in details. As I understand exactly FormsAuthenticationModule checks cookie and fills up HttpContext.User. But I can't find where FormsAuthenticationModule is registered for my application?

Answer 1

It's inherited from root web.config. For example, if you have .NET 4 installed on x64 machine open C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web.config. In system.web section you'll find the following modules registered:

<httpModules>
    <add name="OutputCache" type="System.Web.Caching.OutputCacheModule" />
    <add name="Session" type="System.Web.SessionState.SessionStateModule" />
    <add name="WindowsAuthentication" type="System.Web.Security.WindowsAuthenticationModule" />
    **<add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule" />**
    <add name="PassportAuthentication" type="System.Web.Security.PassportAuthenticationModule" />
    <add name="RoleManager" type="System.Web.Security.RoleManagerModule" />
    <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule" />
    <add name="FileAuthorization" type="System.Web.Security.FileAuthorizationModule" />
    <add name="AnonymousIdentification" type="System.Web.Security.AnonymousIdentificationModule" />
    <add name="Profile" type="System.Web.Profile.ProfileModule" />
    <add name="ErrorHandlerModule" type="System.Web.Mobile.ErrorHandlerModule, System.Web.Mobile, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
    <add name="ServiceModel" type="System.ServiceModel.Activation.HttpModule, System.ServiceModel.Activation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
    <add name="UrlRoutingModule-4.0" type="System.Web.Routing.UrlRoutingModule" />
    <add name="ScriptModule-4.0" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>
</httpModules>

ASP.NET merges it with all web.config files it finds down the hierarchy on file system so applications have all the modules enabled by default.