Can I be sure that HttpModules are executed in the order in which they are listed in the HttpApplication.Modules collection?

Question

I want to write an IHttpModule that has to be executed strictly after FormsAuthenticationModule, otherwise it will be useless.

There's HttpContext.Current.ApplicationInstance.Modules property that returns a collection of IHttpModules. I can check that my module is after FormsAuthenticationModule in this collection.

Will that be enough? Does that collection list IHttpModules in the order in which they are executed?

score 16 · Accepted Answer · answered Feb 20 '13 at 07:07

16

Recall that modules can subscribe to different pipeline events. Within any given pipeline event, modules should run in the order in which they're specified in the Modules collection.

As a practical example, imagine a Modules collection which has these three modules registered:

Module A, which subscribes to EndRequest
Module B, which subscribes to BeginRequest and EndRequest
Module C, which subscribes to AuthenticateRequest

The order of execution will be:

Module B, BeginRequest
Module C, AuthenticateRequest
Module A, EndRequest
Module B, EndRequest

Since the FormsAuthenticationModule subscribes to the AuthenticateRequest event, consider making your own module subscribe to the PostAuthenticateRequest event. That way you're guaranteed that if the FormsAuthenticationModule logic runs, it runs before your logic, regardless of the order in which they're registered in the Modules collection.

answered Feb 20 '13 at 07:07

Levi

32,628
3
87
88

1

I see your point, but I can't use `PostAuthenticateRequest` because my module has to undo what FormsAuthenticationModule has done in its `EndRequest` handler, so I absolutely have to have my code in `EndRequest` handler of my module. – sharptooth Feb 20 '13 at 11:24
Can you explain what exactly you're trying to do? If you're trying to suppress the FormsAuthenticationModule's automatic "turn 401 into a redirect" behavior, then set HttpResponse.SuppressFormsAuthenticationRedirect = true at some point during the request. – Levi Feb 20 '13 at 18:09
That property only appeared in ASP.NET 4.5. Yes, I'm trying to suppress exactly that thing. – sharptooth Feb 21 '13 at 06:13

Gregory Nozik · Answer 2 · 2013-02-20T12:11:06.577

I will try to answer it .

I do not think you should rely on HttpContext.Current.ApplicationInstance.Modules collection, because you do now in which order module will be executed.

Please note that I did't do any prototype, it's just my thought .

The dll Microsoft.Web.Infrastructure.dll has a method for register dynamically HTTP module

The dll is shipped with WebPages 1.0

Create helper class for registration

public static class RegisterHttpModuleHelper
{

    public static void Start()
    {

        DynamicModuleUtility.RegisterModule(typeof(YourCustomModule));
    }
}

FormsAuthenticationModule has event "Authenticate".

On hander of this event , try to dynamicaly register your Custom HttpModule using

public void FormsAuthentication_OnAuthenticate(object sender, FormsAuthenticationEventArgs args)
{
    RegisterHttpModuleHelper.Start()
}

Can I be sure that HttpModules are executed in the order in which they are listed in the HttpApplication.Modules collection?

2 Answers2

Linked