表单身份验证是否记住身份验证？

Question

preview: In my web.config - I don't use forms authentication. I set forms cookie myself.

However - Sometimes I see code like this :

/*1*/   protected void Application_AuthenticateRequest(Object sender, EventArgs e)
/*2*/    {
/*3*/     if (HttpContext.Current.User != null)
/*4*/       {
/*5*/        if (HttpContext.Current.User.Identity.IsAuthenticated)
/*6*/          {
/*7*/              //...
/*8*/              HttpContext.Current.User = ....
/*9*/              //...
/*10*/          }
/*11*/        }
/*12*/   }

Looking at line #5 —

How can it ever be authenticated if line#8 is about to set authentication ?

I mean - line #8 is the one who set authentication for that specific request and when the request is finished , there is no "memory" for future requests. ( cookie expiration is merely - for how long to keep the persistent cookie).

Question

• In what scenarios would line #5 return true ?
• In what scenarios would line #3 would be null ?

nb , this question assumes that begin_request event is not setting anything , and the only stage where authentication is set is on Application_AuthenticateRequest . — I don't use membership engine.

---

placeholder :

http://msdn.microsoft.com/en-us/library/aa289844(v=vs.71).aspx

Answer 1

Line #3 can become null if the login cookie expires. Line #5 is true if the user is logged in.

It can seem like these two methods go hand-in-hand and in fact they do. It can be easier to check for HttpRequest.IsAuthenticated . For more information see here:

asp.net membership IsApproved false but still allowing login

And here:

http://msdn.microsoft.com/en-us/library/system.web.httprequest.isauthenticated%28loband%29.aspx

I do not have an answer to your main question though. Sorry.

In addition to my comment below you may find this link helps explain the abilities of adding roles to existing principles. http://msdn.microsoft.com/en-us/library/vstudio/5k850zwb%28v=vs.100%29.aspx