Where in the request pipeline is PreAuthenticate called

When in the Order of Operations is the IAuthWithRequest.PreAuthenticate() methods for configured AuthProviders of the AuthFeature fired?

It’s only called conditionally when it’s needed, either in the [Authenticate] Request Filter Attribute before validating if a user is authenticated, or the first time the Users Session is retrieved for that request, i.e. with req.GetSession().

thank you, makes sense