Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB

8.6. Session State for Applications Running in IIS 7.0 Integrated Mode

When an ASP.NET application is running under the default application pool inside IIS 7.0 (i.e., integrated mode), the HTTP request processing pipelines get unified and integrated into a single pipeline, enabling the application to access any request that reaches IIS 7.0's gate. This means that both native and managed requests will pass through the unified HTTP request pipeline. If the current request is for a native or non-managed resource, the managed handler is null and the native request will be processed and executed by the IIS 7.0 core engine.

As you learned in Chapter 3, the session state of an ASP.NET web application is accessible after the AcquireRequestState event of the HTTP request pipeline is fired. At this stage, the SessionStateModule that has already subscribed to the AcquireRequestState in the HTTP request pipeline would fire its AcquireRequestState's event handler and get the session state initialized for the current request. Several conditions are checked, of course, to ensure the session state can be initialized, among which the handler for the current request implements the IRequestSessionState interface, which is a marker interface with no methods or properties inside to be implemented by the implementer. If the handler for the current request is a managed handler (that is, a handler for .aspx files, .asmx files, and so on), then the process of initializing the session state for the current ...