title: ASP.NET Webforms Authorization
body: <p>I want to implement the Authorization for my project. It would be a custom authorization where admins can create roles and assign to users. The authorization is simple at the page level, either a user has access to page or not. Now can somebody suggest which is a best place to write the code for authorizing users - Global.asax or HttpModule? or somewhere else?</p>
  
  <p>I have a Session variable which I need to access while authorizing users. I tried writing code in <strong>Application_AuthenticateRequest</strong>(Globaal.asax) but found that session is inaccessible in it. After googling, I found Application_PreRequestHandlerExecute is a safe place for Session to be accessible in Global.asax. So my question is that if <strong>Application_PreRequestHandlerExecute</strong> is called for each and every Request? and a safe place to write code for authorization? At times, I have noticed the Session is null in this event too.</p>