The media library images in our solution are protected by a custom override on the Sitecore MediaRequestHandler. This, in turn, checks against some Sitecore configuration item whether or not a user is permitted to access this media item or pdf. This system works great once a session is already started.

If a user tries to access the media item directly by URL in a new session, the MediaRequestHandler checks if a user is permitted to access the media item before our (custom, not Sitecore based) autologin system in Global.asax.cs in Session_Start has the chance to auto-login the user. Of course, once the user tries to access the media item again, everything works as expected, because then the session is already established.

Is there a way to change the order of the media request handler so that it only fires after Session_Start?

1 Answer 1


I've been looking at the code in the MediaRequestHandler - the one that is wired in to handle your media requests.

<add verb="*" path="sitecore_media.ashx" type="Sitecore.Resources.Media.MediaRequestHandler, Sitecore.Kernel" name="Sitecore.MediaRequestHandler"/>

It basically has some custom handling around handling user login requirements and calls some internal methods to try and fix that. Rewriting this logic would probably be a lot more pain that it is worth.

The alternative would be, to force a session to be active for this HttpHandler. Be aware of the potential for resource cost this may have on your server.

The way to do it, would be to implement your own handler - inheriting from Sitecore's - and patch it in, in the config snippet I showed above. Something like:

public class SessionMediaRequestHandler : Sitecore.Resources.Media.MediaRequestHandler, IReadOnlySessionState

That might actually be all the code you need. The IReadOnlySessionState will make sure a session gets triggered before the handler is called - which in turn should trigger your custom code.

Reference: Getting Session State in HttpHandlers (ASHX files)

  • I was looking into trying to check for an active session in my custom MediaRequestHandler code, but was going to use it to conditionally redirect, and stumbled across IReadOnlySessionState, which you suggested. Going to try your approach now, which makes a whole lot more sense. Jan 3, 2019 at 13:39
  • 1
    Had a bit of trouble getting it to work on my setup, but got it to work in the end. Thanks! Jan 3, 2019 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.