How does IIS persist a user's identity from page to page in an ASP.net application?

Web pages are, by nature, state-less objects. When you click from page to page in an ASP.net application, each request for a page is treated as a brand-new request. We use things like cookies, session-variables, and query开发者_开发知识库 strings to maintain state from page to page.

When you log in to an ASP.net web application using Windows Authentication, how does IIS persist your identity between pages?

If you use something like Fiddler2, or any other web proxy tool, you can look at the header and see that for Windows Integrated Authentication, it gets the domain/username from the header, so it is able to know who you are, and then it will probably be using a session to help keep state between pages.

Session is identified usually by a cookie (the 'session cookie') unless you set your app to be "cookieless", in which case the identifier is in the url.

http://msdn.microsoft.com/en-us/library/aa479314.aspx

The browser "helps out" in the case of domain authentication. Instead of asking you on every request, it remembers what you entered the first time and keeps re-sending it along with every request for that site.