How is User Identity | Principal set during the application lifecycle
asp.net-mvc, asp.net-web-api, forms-authentication
Solution
Here is a related answer.
Identity can be set in a handler, in a module, or in Global.asax. You can modify it at any point in the request lifecycle, but usually the best place to do it is in PostAuthenticateRequest. At this point, FormsAuthentication has done it's work and you can augment or replace the HttpContext.Current.User.
Problem
In ASP.NET (MVC and WebAPI), how is the User Identity object initialized with the data from the FormsAuthentication cookie? What I want to do is to use 2 types of authentication, cookie based and a custom header based one. Since the `AuthorizeAttribute` class only checks the `User.Identity.IsAuthorized()` method and uses no code specific to FormsAuthentication, then that means all I have to do is to manually setup the `User.Identity` object, whether in the global.asax or in a DelegatingHandler. So, how do I setup User.Identity? How does the framework automatically set it up using FormsAuthentication?