First of all user is authenticated even when the logon is using cookies
Authentication begins when the user requests for a page from the protected application. The server checks if the user is already authenticated by searching for an authentication cookie that contains the authentication ticket in the request.
How that happens is not a magic but is as follows
The class that does that magic for you is formsauthenticationmodule class and in there there is a authenticate event
The FormsAuthenticationModule exposes an Authenticate event that enables you to provide a custom IPrincipal object for the User property of the current HttpContext. The Authenticate event is accessed by specifying a subroutine named FormsAuthentication_OnAuthenticate in the Global.asax file for your ASP.NET application.
public void FormsAuthentication_OnAuthenticate(object sender, FormsAuthenticationEventArgs args)
{
if (FormsAuthentication.CookiesSupported)
{
if (Request.Cookies[FormsAuthentication.FormsCookieName] != null)
{
try
{
FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(
Request.Cookies[FormsAuthentication.FormsCookieName].Value);
args.User = new System.Security.Principal.GenericPrincipal(
new Samples.AspNet.Security.MyFormsIdentity(ticket),
new string[0]);
}
catch (Exception e)
{
// Decrypt method failed.
}
}
}
else
{
throw new HttpException("Cookieless Forms Authentication is not " +
"supported for this application.");
}
}
This is how it all happens, please refer here http://msdn2.microsoft.com/en-us/library/system.web.security.formsauthenticationmodule.aspx
You would also like to know that there is also another event called PostAuthenticate Event
The FormsAuthenticationModule class constructs a GenericPrincipal object and stores it in the HTTP context. The GenericPrincipal object holds a reference to a FormsIdentity instance that represents the currently authenticated user.
You should allow forms authentication to manage these tasks for you.
If your applications have specific requirements, such as setting the User property to a custom class that implements the IPrincipal interface, your application should handle the PostAuthenticate event.
The PostAuthenticate event occurs after the FormsAuthenticationModule has verified the forms authentication cookie and created the GenericPrincipal and FormsIdentity objects.
Within this code, you can construct a custom IPrincipal object that wraps the FormsIdentity object, and then store it in the HttpContext. User property.
Note
If you do this, you will also need to set the IPrincipal reference on the Thread.CurrentPrincipal property to ensure that the HttpContext object and the thread point to the same authentication information.
Please let me know if you understand it correctly now..
Please Mark Post that helped you as answer, also include a summary of what solved the problem as it helps others in similar situations