Hello!
We wrote a custom authorization engine for our ASP.NET application. It is database-driven and controls various things, which an authenticated user (Forms authentication) can / cannot do. It is not based on a provider model.
Among other things, it includes a Boolean method which determines if a current user can see a particular page. The only input parameters are a relative URL of a page and HttpContext.User.Identity.Name.
We are creating an HttpModule which will [initialize our authorization engine and] add a call to that page-authorization method to a suitable event handler.
Now a question: what event is most suitable for calling our page-authorization method? Should we call our method in PostAuthenticateRequest? In AuthorizeRequest? (Again: standard ASP.NET authorization mechanisms are not used, our engine is used instead.)
Some preliminary (and slightly outdated) information about our authori ...
Go to the complete details ...