---
title: Register AuthenticateRequest handler
summary: Wire the HTTP module into the ASP.NET request-authentication pipeline.
status: draft
owner: SAIF Documentation Team
last_reviewed: 2026-07-30
library: SAIF.Framework.SecurityModule
reference_type: package
operation_id: register-authenticate-request-handler
trigger: ASP.NET calls IHttpModule.Init during module initialization.
---

# Register AuthenticateRequest handler

This operation runs once per module instance, when ASP.NET first initializes `clsSecurityModule`. Its sole purpose is to attach the module's request-authentication handler to the hosting application's `AuthenticateRequest` event, which is what makes every subsequent inbound request pass through this library's authentication logic before reaching the application.

| Field | Value |
| --- | --- |
| **Operation ID** | `register-authenticate-request-handler` |
| **Trigger** | ASP.NET calls `IHttpModule.Init` during module initialization. |
| **Inputs** | `context As HttpApplication` |
| **Outputs** | `AuthRequest_Handler` subscribed to `context.AuthenticateRequest` |
| **Primary components** | `clsSecurityModule.Init` |
| **Entry point** | `SAIF.Framework.SecurityModule\clsSecurityModule.vb` |

## Steps

1. Receive the hosting `HttpApplication` instance from the ASP.NET runtime.
2. Register `AddressOf AuthRequest_Handler` with `context.AuthenticateRequest`, so that every future request on this application enters the module's authentication workflow.
3. Return immediately without storing any additional module state.
   - On failure: the method contains no local error handling, so any exception raised during registration propagates unchanged to the hosting runtime.
4. Leave cleanup empty, since `Dispose()` is implemented as a no-op and the module holds no resources that need releasing.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([ASP.NET initializes module]) --> S1[Receive HttpApplication]
	S1 --> S2[Attach AuthRequest_Handler to AuthenticateRequest]
	S2 --> EndOk([Module ready for request authentication])
```

## Failure and edge-case behavior

- `Dispose()` performs no unregistration or cleanup, so the module relies entirely on the hosting ASP.NET runtime for its lifetime management.
- The method does not guard against duplicate registration; it assumes ASP.NET calls `Init` exactly once per module instance, which is the standard `IHttpModule` contract.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [Configuration](../configuration.md)

## Sources
- `SAIF.Framework.SecurityModule\clsSecurityModule.vb`