Hi Stef,
Its a server side web request to retrieve the content of the custom 404, there is no server.transfer nor response.redirect involved. I certainly am not aware of an easy way to impersonate the user because its based on cookies so the server side request we make is not going to have the user's authentication cookies.
Generally I think the perception problems you are talking about are because our custom 404 looks too much like a normal page, many sites solve this by having minimal content and links on the page to make it more clear that its an error page (albeit a friendly one) and I think this would clear up any ambiguity of perception probably better than trying to adapt it so it keeps the user context. Whereas right now the page looks so normal that it is perceived like any normal page rather than as an error page.
When I look at these examples of custom 404 pages I only see a few where they show a menu at all, most of them go for a very clean friendly error page without menus or other things that make it seem like a normal page in the site
I generally prefer simple solutions to complex ones. I can easily make the error page not select/highlight a page in the menu and I can easily remove things that lead to confusion but I do not want to add a lot of complexity to make it seem like no error has happened. A 404 is an error and perhaps the issue is that we've gone too far in making it look like a normal page, but since its not quite all the way normal its more confusing.
Its currently possible to use a custom 404 other than the one we include. The config setting <add key="Custom404Page" value="/PageNotFound.aspx" /> allows you to define your own custom 404 page.
Best,
Joe