Sequence diagram for ASP.NET application events in Global.asax

There are two types of events in global.asax file in your application domain:

1. Events which get called for every request.
2. Events only get invoked under certain conditions.

For the first type of events which occur for every request, they get executed in the following order:

1. Application_BeginRequest(): This is called at the start of every request.
2. Application_AuthenticateRequest(): This is called just before authentication is performed. You could add your own authentication logic in this method to provide custom authentication.
3. Application_AuthorizeRequest(): This is called when the authentication stage is completed. It's executed at the stage to determine user privileges and permissions. You could add custom code to assign user special privileges.
4. Application_ResolveRequestCache(): This is often used in conjunction with output caching. With output caching, the rendered HTML of a page is reused without executing its code. However, this event handler still runs.
5. ----------Then the request is sent to its assigned handler. For example, an ASP.NET web form page is sent to compilation (if it is due) and instantiation.----------
6. Application_AcquireRequestState(): This is called just before session-specific data is retrieved for the client and is used to populate Session Collection.
7. Application_PreRequestHandlerExecute(): This is called before the appropriate HTTP handler executes the request.
8. ----------The handler now executes the request. The code of your ASP.NET web form page is now executed and the HTML is now rendered.----------
9. Application_PostRequestHandlerExecute(): This is called just after the request is handled by its appropriate HTTP handler.
10. Application_ReleaseRequestState(): This method is called when the session-specific information is about to be serialized from the Session Collection so that it's available for the next request.
11. Application_UpdateRequestCache(): This is called just before information is added to the output cache. If you have enabled output caching for your web page, it's now the time ASP.NET insert the rendered HTML into the cache.
12. Application_EndRequest(): This is called at the end of the request, right before the objects are released and reclaimed. It's the place to add your cleanup code.

This diagram below can help you grab a better insight of this cycle:


In general, developers are more likely to provide handling code for Application_BeginRequest(log information for analysis, routing, etc.), Application_AuthorizeRequest(custom authorization and privilege etc.) and Application_EndRequest(log information for analysis, cleanup, etc.).
For the second type of application events which do not fire upon every request, there are six of them:

1. Application_Start(): This is called when the application first starts up and the application domain is created. This is the place for you to insert application-wide initialization code. For example, you may want to add code here which load and cache data, load some application-wide configuration setting, navigation trees and other static data and information which will stay persistent throughout the lifetime of your application.
2. Session_Start(): This method is invoked each time a new session begins, This is often used to initialize user-specific information. Some developers also use this to count the number of current active user session in the application.
3. Application_Error(): This is invoked whenever an unhandled exception occurs in the application. You may want to use this to perform some custom error handling logic application-wide.
4. Session_End(): This is called when a user session ends. A session ends when your code releases it explicitly or its idle time exceeds the set expiry timeout (by default 20 minutes, you may change it in your web.config). Developers typically add code here to clean up any related data. Note that this method is only called if you are using in-process session state storage (InProc mode, not StateServer of SQLServer modes).
5. Application_End(): This method is invoked just before an application ends. The end of an application can occur because IIS is shut down or the application is transitioning to a new domain in response to file updates or process recycling.
6. Application_Disposed(): This method is called some time after the application is shut down and the garbage collector is about to reclaim the memory it occupies (just like other objects' disposal in .NET). Note that it is already too late to perform critical cleanup at this point of time. But you may want to add code here to verify that resources have been released as a last-ditch safe-proof.

http://www.freewebdevelopersite.com/2011/03/21/application-events-in-global-asax/