---
title: clsSecurityModule
summary: API reference for clsSecurityModule.
status: draft
owner: <owner>
last_reviewed: 2026-07-23
library: SAIF.Framework.SecurityModule
reference_type: package
---

# clsSecurityModule

`clsSecurityModule` is the ASP.NET `IHttpModule` pipeline entry point for this library. It registers an `AuthenticateRequest` handler that drives the entire authentication flow — short-circuiting already-authenticated users, delegating to the internal/external authenticator strategy, and routing unhandled exceptions to a configured error page.

## Purpose
- Hook into the ASP.NET request pipeline and orchestrate authentication for every inbound request.
- Own top-level exception handling for the authentication flow, distinguishing benign `Response.Redirect`-induced `ThreadAbortException`s from real errors.

## Context
- Namespace: `SAIF.Framework.SecurityModule`
- Assembly/package: `SAIF.Framework.SecurityModule` (packaged inside the `SAIF.BOF.Framework` NuGet package)

## Public members
| Member | Signature | Purpose |
| --- | --- | --- |
| `ErrorPage` | `Public ReadOnly Property ErrorPage As String` | Returns the configured error page URL (`sec-errorpage` app setting), defaulting to `/WebError/ProcessError.aspx` if not set. |
| `Dispose` | `Public Sub Dispose()` | `IHttpModule.Dispose` implementation; performs no cleanup (empty body). |
| `Init` | `Public Sub Init(context As HttpApplication)` | `IHttpModule.Init` implementation; wires `AuthRequest_Handler` to `context.AuthenticateRequest`. |
| `AuthRequest_Handler` | `Protected Sub AuthRequest_Handler(sender As Object, e As EventArgs)` | Core authentication flow: resolves already-authenticated short-circuit, selects an authenticator via `UserAuthenticator.Find`, invokes `Authenticate`, and handles exceptions (see [BR-005](../../business-rules.md#br-005-thread-abort-exceptions-from-response-redirect-must-not-be-treated-as-authentication-errors), [BR-006](../../business-rules.md#br-006-any-unhandled-authentication-exception-redirects-to-the-error-page)). |

## Behavioral notes
- Implements `System.Web.IHttpModule`, so a hosting web application must register it in `Web.config`'s `<httpModules>` / `<system.webServer><modules>` section for the module to take effect; no such registration exists inside this library's own folder to confirm.**
- On entry, `AuthRequest_Handler` logs "Begin"/"End" via `mdlLogging` and checks [BR-001](../../business-rules.md#br-001-already-authenticated-users-are-not-re-processed) before delegating to `UserAuthenticator.Find`.
- Carries assembly-level `<Assembly: log4net.Config.XmlConfigurator(ConfigFile:="..\log4net.config")>` and `<Assembly: SecurityPermissionAttribute(SecurityAction.RequestMinimum, UnmanagedCode:=True)>` attributes, reflecting the module's reliance on log4net configuration and unmanaged P/Invoke calls elsewhere in the library.

## Constraints and usage notes
- The class does not expose a constructor beyond the implicit default; it is expected to be instantiated by the ASP.NET runtime as a registered `IHttpModule`, not constructed directly by application code.*
- `ErrorPage` is evaluated once as a property initializer at construction time, not re-read from `AppSettings` on each request.

> **Note:** Statements marked with * were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with ** could not be confirmed; treat as unknown until verified.

## Sources
- `SAIF.Framework.SecurityModule\clsSecurityModule.vb`