Recall that the BeginRequest event fires before AuthenticateRequest, which fires before AuthorizeRequest. One safe place that URL rewriting can be performed is in the BeginRequest event. That means that if the URL needs to be rewritten, it will have done so by the time any of the built-in HTTP modules run. The downside to this approach arises when using forms authentication. If you've used forms a