title: How to maintain session information across authentication
body: <p>I using ServiceStack authentication with a custom session object. I've got everything set up with different authentication providers and everything is working fine.</p>
  
  <p>Now a want to store some information in the session before the user is authenticated (Think shopping cart). But we loose that information when the user logs in later. Looking at the code in the <a href="https://github.com/ServiceStack/ServiceStack/wiki/Authentication-and-authorization" rel="nofollow">documentation</a> this makes sense:</p>
  
  <pre><code>Plugins.Add(new AuthFeature(() =&gt; new AuthUserSession(),
    new IAuthProvider[] { 
      new BasicAuthProvider(), //Sign-in with Basic Auth
      new CredentialsAuthProvider(), //HTML Form post of UserName/Password credentials
    }));
  </code></pre>
  
  <p>The authentication removes the existing session whenever a user logs in. This makes sense when the old login is a valid user, you want to make sure it's fully logged out. However when the current session isn't authenticated there doesn't seem to be much reason to do so.</p>
  
  <p>I've been looking at a custom session factory, but that doesn't help me because as <code>() =&gt; new AuthUserSession()</code> shows, there isn't any context to use when creating the new session. Without a way to get the old session there I've got no way to copy any information. </p>
  
  <p>I can work around it by overriding <code>AuthProvider.Authenticate()</code> and grab the required information before calling base. But that means doing so in every authentication provider we use and the ones we might use in the future. That doesn't really feel like the correct solution.</p>
  
  <p>Is there a cleaner way to carry information across the authentication? Preferably something which works regardless of the AuthProvider used.</p>