title: MVC 5: How Does Application_PostAuthenticateRequest() get called in Global.asax?
body: <p>When setting up custom principals for the <code>[Authorize]</code> attribute to work in Microsoft's MVC version 4 and 5, we need to go into Global.asax.cs and set up a method called <code>Application_PostAuthenticateRequest()</code>. I've done that in my current project, and it works just fine.</p>
  
  <p>However, it really bugs me how much this seems like "magic". <code>Application_PostAuthenticateRequest()</code> is not a virtual method. I'm not overloading or implementing any existing method signature in the class. So how does the MVC framework know to call it? C# is a strongly typed language, after all, and you don't get to call a method on a class unless you know it's there. </p>
  
  <p>The only way I can see doing it is via Reflection. Maybe going through the final object's methods and assigning any methods that match a certain signature to delegates. But I really have no idea. And I don't understand why the designers would do that rather than just implementing a virtual method. </p>
  
  <p>So, in summary, (A) how is <code>Application_PostAuthenticateRequest</code> being called when it's not a defined method of the global.asax class, and (B) why didn't they just make it a virtual method?</p>