I stumbled across "Performance Gain – Security Risk" which provides a very good and simple example of why one should be careful when using Server.Transfer(). Transfer has a benefit over Redirect as it doesn't have the same performance cost by going through the ASP.NET pipeline, but that has the cost of not going through authorization. The takeaway, be careful, and don't transfer into secure areas of your site