Recently I wrote a Text-To-Image .ashx handler. I noticed a particular problem with child portals, authenticated users would be logged out immediately after login. Meaning, they could access a site after login, but clicking any link resulted in a new login form. After logging in again, the same thing happens, over and over again. This only happened with child portals and with user accounts other than the SuperUser account, which worked fine.

The problem is that the ashx requests to my image handler are being run through the Url Rewrite  HttpModule. The Url Rewrite Module requires a portalid in its query string if the request is of type .ashx. If there is no portalid specified, the session's current portal id is being reset to Portal 0. Which obviously confuses the authentication process.

Questions:

a) Why do I have to specify a portalid querystring parameter in all my ashx handlers / Why does the Url Rewrite HttpModule bother to handle .ashx requests?
b) Why isn't this documented? If it is, where is it documented?

DNN Version is 5.1.3