Author: vkelman | Posted on: 3/11/2009 10:24:10 PM | Views : 284

Hello!

We wrote a custom authorization engine for our ASP.NET application. It is database-driven and controls various things, which an authenticated user (Forms authentication) can / cannot do. It is not based on a provider model.
Among other things, it includes a Boolean method which determines if a current user can see a particular page. The only input parameters are a relative URL of a page and  HttpContext.User.Identity.Name.
We are creating an HttpModule which will [initialize our authorization engine and] add a call to that page-authorization method to a suitable event handler.

Now a question: what event is most suitable for calling our page-authorization method? Should we call our method in PostAuthenticateRequest? In AuthorizeRequest?  (Again: standard ASP.NET authorization mechanisms are not used, our engine is used instead.)

 Some preliminary (and slightly outdated) information about our authori ...

Go to the complete details ...