---
title: Initialize a request
summary: Runs the fixed per-request lifecycle for every SAIF WebForms screen — timeout handling, security, menu authorization, model initialization, and context processing.
status: draft
owner: SAIF Doc Gen
last_reviewed: 2026-08-17
library: SAIF.Presentation.Web.MVC
reference_type: package
operation_id: OP-MVC-01
trigger: ViewPageBase.Page_Init, after clsFactoryBase produces the controller
---

# Initialize a request

Every derived `.aspx` page runs this operation once per request, before any page-specific logic executes. It is the fixed sequence that turns a raw HTTP request into an authenticated, authorized, model-backed screen: session-timeout handling, security establishment, menu-based page authorization, model initialization, and query-string/cross-application context processing.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-MVC-01 |
| **Trigger** | `ViewPageBase.Page_Init` (or `ViewControlBase.Page_Init`) after the factory produces the controller |
| **Inputs** | `HttpContext.Current` (session, request, query string, referrer), session keys `navdata`, `<ViewID>-model`, `<ViewID>-viewdata` |
| **Outputs** | Established security principal, cached `NavigationContext`, initialized model, applied query string and inbound context; possibly a redirect |
| **Primary components** | `clsControllerBase.Initialize` |
| **Entry point** | SAIF.Presentation.Web.MVC/clsControllerBase.vb |

## Steps

1. Check `IsSessionTimedOut` — a postback arriving on a new session. If timed out and the caller is internal (`IsInsideClient`), redirect to `/<ApplicationName>?MSG=Your session has timed out.` ([BR-MVC-001](../business-rules.md#br-mvc-001-session-timeout-treated-as-an-unprocessable-postback), [BR-MVC-002](../business-rules.md#br-mvc-002-internal-users-are-returned-to-the-app-landing-page-on-timeout)).
   - On failure: `ThreadAbortException` from `Response.Redirect` is caught, `ResetAbort` is called, and `Response.End()` runs in `Finally` ([BR-MVC-012](../business-rules.md#br-mvc-012-redirect-induced-thread-aborts-are-suppressed)).
2. If timed out and the caller is external, add an empty `SAIFAUTH` cookie and redirect to `/OnlineLogin/LoginScreen.aspx`, with the same abort handling ([BR-MVC-001](../business-rules.md#br-mvc-001-session-timeout-treated-as-an-unprocessable-postback), [BR-MVC-003](../business-rules.md#br-mvc-003-external-users-are-sent-to-the-login-screen-on-timeout), [BR-MVC-012](../business-rules.md#br-mvc-012-redirect-induced-thread-aborts-are-suppressed)).
3. If the query string carries `__SAIFPID`, assign it to `ViewPage.ViewID` so the request rejoins the correct model instance ([BR-MVC-008](../business-rules.md#br-mvc-008-multi-model-view-state-is-keyed-by-a-per-view-guid)).
4. Call `SecurityCheck()`.
   - Embeds [Establish the security principal](establish-security-principal.md) ([BR-MVC-004](../business-rules.md#br-mvc-004-every-request-carries-a-single-established-security-principal), [BR-MVC-005](../business-rules.md#br-mvc-005-unauthenticated-callers-are-challenged-or-refused-by-network-zone)).
5. If `Session("navdata")` is empty, construct `NavigationContext(Model.Context.UserID)` and cache it in session ([BR-MVC-006](../business-rules.md#br-mvc-006-the-authorized-menu-set-is-loaded-once-per-session)).
   - Embeds [Load the user's authorized menu](load-authorized-menu.md), which reads Oracle menu tables through `SAIF.Business.Menu`.
6. Call `RedirectUnauthorizedUsers()`.
   - Embeds [Enforce menu-based page authorization](enforce-menu-authorization.md) ([BR-MVC-007](../business-rules.md#br-mvc-007-page-access-requires-menu-authorization)).
7. Call `Model.Pre_Init()` — the model initializes once and loads `clsPreferences` for the user/application ([BR-MVC-016](../business-rules.md#br-mvc-016-a-model-initializes-exactly-once-per-instance)).
   - On subsequent calls within the same instance: no-op (the `m_Inited` guard prevents re-initialization).
8. Call the overridable `Load()` hook so the derived controller can prepare screen state.
9. If the request has query-string keys, call `ProcessQueryStrings()` → `HandleQuerystring(QueryString)` (derived hook).
10. If a referrer exists, call `CheckContext(referrer.LocalPath)`.
    - Embeds [Receive inbound cross-application context](receive-inbound-context.md) ([BR-MVC-010](../business-rules.md#br-mvc-010-every-navigation-records-sourcetarget-app-and-view), [BR-MVC-017](../business-rules.md#br-mvc-017-cross-application-context-is-consumed-exactly-once)).
    - If no referrer: no cross-app context processing occurs.

## Process flow

The following diagram visualizes this operation's control flow.

```mermaid
flowchart TD
	Start([Page_Init]) --> S1{IsSessionTimedOut?}
	S1 -->|internal| S2([Redirect: app landing page])
	S1 -->|external| S3([Clear SAIFAUTH, redirect login])
	S1 -->|no| S4[SecurityCheck]
	S4 --> S5{Session navdata empty?}
	S5 -->|yes| S6[Load NavigationContext]
	S5 -->|no| S7[RedirectUnauthorizedUsers]
	S6 --> S7
	S7 --> D{Authorized?}
	D -->|No| EndErr([Redirect to login screen])
	D -->|Yes| S8[Model.Pre_Init + Load]
	S8 --> S9[Process query strings]
	S9 --> S10[CheckContext if referrer present]
	S10 --> EndOk([Continue to page lifecycle])
```

## Failure and edge-case behavior
- A session that appears timed out is never processed further in the current request — the pipeline stops at step 1/2 with a redirect.
- If `RedirectUnauthorizedUsers` denies access, `Session("navdata")` is cleared, forcing a fresh menu load on the next request.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)
- [SQL catalog](../sql/index.md)
- [Database tables](../database-tables.md)

## Sources
- SAIF.Presentation.Web.MVC/clsControllerBase.vb
- SAIF.Presentation.Web.MVC/ViewPageBase.aspx.vb