in asp.net what sets Request.IsAuthenticated = true

Question

Possible Duplicate:
asp.net membership IsApproved false but still allowing login

i am having a user register but IsApproved is false but when i check Request.IsAuthenticated it still returns true.

Do you know how this can happen?

Solution

HttpRequest.IsAuthenticated returns true if HttpContext.User.Identity is not null and it's IsAuthenticated property returns true.

The current identity is set in the FormsAuthenticationModule, but it has nothing to do with your MembershipProvider. In fact, it doesn't even reference it. All it does is check to see if the authentication cookie is still set and is still valid (as is, has not expired).

I think the problem is that you are calling one of the FormsAuthentication methods like RedirectFromLoginPage, which is settings the authentication cookie. If you need to wait until the user is approved, then you need to make sure you are not setting the cookie.