Does FormsAuthenticationModule detect whether …?

Question

Hello,

FormsAuthenticationModule is used for tracking user and role information using encrypted cookie.

But does this module also contain code that actually detects whether user requesting web page has forms authentication ticket and if not, redirects user to login page, or is it actually UrlAuthorizationModule that tells FormsAuthenticationModule to redirect unauthorized/unauthenticated user to the login page?

thanx

Answer 1

According to the documentation, the FormsAuthenticationModule only

Sets the identity of the user for an ASP.NET application when forms authentication is enabled.

However, looking around elsewhere (props to Erv for pointing this out) the forms authentication module is then responsible for redirecting the user to the login page by hooking into the application's EndRequest Event

This means it has nothing to do with with roles - roles are handled by the RoleManagerModule

So the UrlAuthorizationModule uses the Authentication Module (i.e. Forms, Passport/Live, Windows, etc) and Role provider (using which Role module is appropriate) that are configured in the web config to enforce access, and if the CheckUrlAccessForPrinciple that's actually checking the users access rights returns false, a 401 error is raised, and this is then returning to ASP.NET to handle.

The app then raises the EndRequest Event, which is picked up by the FormsAuthenticationModule which finally redirects the user to the Default login page defined in the Forms auth section of the web.config.

Answer 2

Oddly enough, I just researched this this week.

It turns out that the FormsAuthenticationModule does do the actual redirect in EndRequest event handler. However, it doesn't decide that the redirect should happen. It does the redirect if the response status code is 401 (Unauthorized).

The UrlAuthorizationModule is the place where the decision is made (as mentioned in another answer), but all it does is indicate that the request is not authorized by setting the response status code to 401.

So, it is actually the two modules in coordination that make the redirect to the login page happen.