Question

Where exactly does Forms Authentication exist in the Http Pipeline?

Answer 1

Guess I should’ve thought of this first but it didn’t dawn on me until I saw the answer from @Carl Raymond that I can just crack it open in reflector. So to answer my own question

public void Init(HttpApplication app)
{
    if (!_fAuthChecked)
    {
        _fAuthRequired = AuthenticationConfig.Mode == AuthenticationMode.Forms;
        _fAuthChecked = true;
    }
    if (_fAuthRequired)
    {
        FormsAuthentication.Initialize();
        app.AuthenticateRequest += new EventHandler(this.OnEnter);
        app.EndRequest += new EventHandler(this.OnLeave);
    }
}

OnEnter calls the private method OnAuthenticate which passes in the application context and this is where it validates/writes out the Form Auth tickets.

In OnExit it checks the response for a Http Status Error Code 401 and if it finds it, that’s when it redirects to the Login Url.