DEV410 Inside the ASP.NET Runtime - Intercepting HTTP Requests Michele Leroux Bustamante Principal Software Architect IDesign Inc.

Speaker BIO Principal Software Architect, IDesign, Microsoft Regional Director, Microsoft MVP – XML Web Services INETA Speaker’s Bureau BEA Technical Director Web Services Program Advisor, UCSD Blog:

What we will cover: How IIS passes requests to ASP.NET How to configure the ASP.NET pipeline to intercept requests, and why you’d want to How to create useful custom pipeline components HTTP Modules Handler Factories and Handlers SOAP Extensions

Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

IIS & ASP.NET Runtime Configuration IIS passes HTTP requests to ASP.NET through an unmanaged ISAPI extension This is the “hook” between IIS and the ASP.NET HTTP runtime Resource extensions are configured in IIS to be handled by ASP.NET Default configuration excludes *.xml, *.html, graphic file extensions and more

IIS & ASP.NET Runtime Configuration.NET extensions are configured to be handled by aspnet_isapi.dll

IIS & ASP.NET Request Workflow IIS ASP.NET Runtime Application HTTP Response asp.dll aspnet_isapi.dll *.asp *.asmx HTTP Request Process Request Web.config Machine.config

ASP.NET Configuration Machine.config Machine.config defines default handlers or handler factories to manage requests

ASP.NET Configuration Web.config Web.config may alter Machine.config settings at the application level HTTP Handlers can be chosen by: Verb: POST/GET Path: by extension, by specific URL

IIS & ASP.NET Request Workflow IIS ASP.NET Runtime Application HTTP Response asp.dll aspnet_isapi.dll *.asp *.asmx HTTP Request Process Request Web.config Machine.config IHttpHandlerFactory IHttpHandler

IIS 5.0 and ASP.NET Inetinfo.exe aspnet_isapi.dll aspnet_wp.exe IIS 5.0ASP.NET Application Domain HttpHandler Thread Pool Pooled HttpApplication HttpModules

IIS 6.0 and ASP.NET http.sys IIS 6.0ASP.NET inetinfo.exe aspnet_wp.exe w3wp.exe Application Domain HttpHandler

HTTP Pipeline Components Configurable components: HTTP Handler Factories HTTP Handlers HTTP Modules SOAP Extensions Use individually, or combined Configure per application, or globally

IIS ASP.NET Runtime Pipeline Components Page Request HTTP Request HTTP Handler Factory HTTP Handler/Page ASPNET_ISAPI.DLL HTTP Response HTTP Modules

IIS ASP.NET Runtime Pipeline Components Web Method Request HTTP Request HTTP Handler Factory HTTP Handler/ WebServicesHandler Web Service Method ASPNET_ISAPI.DLL HTTP Response HTTP Modules SOAP Extension

Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

HTTP Modules Leverage an event-driven model to interact with Web applications Can interact with every HTTP request Useful for: Custom authorization Global error handler Implementing caching or other utilities Request diagnostics

HTTP Modules WindowsAuthenticationModuleFormsAuthenticationPassportAuthenticationModuleFileAuthorizationModuleUrlAuthorizationModuleSessionStateModule

HTTP Modules Configuration Configured in Configured in Instantiated in order configured Intercept events before the application object (global.asax) receives them … …

HTTP Modules IHttpModule Modules implement IHttpModule Interface IHttpModule { void Init( HttpApplication context ); void Dispose(); }

HTTP Modules Initialization Register for events during Init() protected void Init() { application.PreRequestHandlerExecute += (new EventHandler(this.Application_PreRequestHandlerExecute)); application.PostRequestHandlerExecute += (new EventHandler(this.Application_PostRequestHandlerExecute)); }

HTTP Modules Event Handlers Events based on EventHandler delegate Access to HttpApplication object Can also publish events to listening applications within the module’s scope private void Application_PreRequestHandlerExecute(Object source, EventArgs e) { HttpApplication app = (HttpApplication)source; }

HTTP Modules Application Events HTTP Modules ASP.NET Page Resource BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() HTTP GET somepage.aspx

HTTP Module

Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

HTTP Handler Factories & HTTP Handlers Components configured to handle requests for specific resources HTTP handler factories return an HTTP handler to process the request Or, you can configure the HTTP handler directly Useful for: Intercepting requests for specific resources Overriding how requests are processed Formatting requests for custom types

HTTP Handler Factories System.Web.UI.PageHandlerFactorySystem.Web.Services.Protocols.WebServiceHandlerFactorySystem.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory

HTTP Handler Factories Configuration Register in Register in Can override in application Web.config

HTTP Handler Factories IHttpHandlerFactory Implement IHttpHandlerFactory GetHandler() Returns IHttpHandler type Can access HttpContext and related info ReleaseHandler()Cleanup! interface IHttpHandlerFactory { IHttpHandler GetHandler( HttpContext context, string requestType, string url, string pathTranslated ); void ReleaseHandler( IHttpHandler handler ); }

HTTP Handler Factory Page Request HTTP Modules ASP.NET Page Resource BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() HTTP GET somepage.aspx Handler Factory Handler GetHandler() ProcessRequest()

HTTP Handler Factory Web Service Method HTTP Modules ASP.NET Web Service BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() WebMethod() Handler Factory Handler GetHandler() ProcessRequest()

HTTP Handlers System.Web.HttpForbiddenHandlerSystem.Web.StaticFileHandlerSystem.Web.HttpMethodNotAllowedHandlerSystem.Web.Handlers.TraceHandlerSystem.Web.UI.Page

HTTP Handlers Configuration Can directly configure IHttpHandler instead of IHttpHandlerFactory Factory used when specific handler may vary per request specifics

HTTP Handlers IHttpHandler Implement IHttpHandler ProcessRequest() Invoked by HttpRuntime Handle the request accordingly IsReusable If resource can be shared, return true Interface IHttpHandler { void ProcessRequest(HttpContext context ); bool IsReusable {get;} }

HTTP Handler Factories & Handlers

HTTP Handlers Accessing Session To access Session from a custom handler, implement marker interface, IRequiresSessionState class CustomHandler: IHttpHandler, IRequiresSessionState { public void ProcessRequest(HttpContext context ) { object somdData = context.Session[“data”]; … } public bool IsReusable { get { return true;} }

HTTP Handlers Asynchronous Handlers Asynchronous design pattern Offloads request to a new thread Frees thread from the application thread pool for better performance Limited gains without scalable architecture interface IHttpAsyncHandler : IHttpHandler { IAsyncResult BeginProcessRequest( HttpContext context, AsyncCallback cb, object extraData ); void EndProcessRequest(IAsyncResult result ); }

HTTP Handlers *.ASHX Handlers may be defined in an.ashx file Flexible, lightweight implementation No IIS configuration required With or without code-behind public class MyCustomHandler: IHttpHandler {…}

Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

Message Serialization ASP.NET uses XmlSerializer to serialize/deserialize SOAP messages Web Service Client Application Web Method SOAP Request XML Serialize Deserialize Parameters Return Value SOAP Response XML Client Proxy Parameters Return Value Serialize Deserialize

IIS ASP.NET Runtime SOAP Extensions HTTP Request Web Service Method ASPNET_ISAPI.DLL HTTP Response Validate/Transform Authorize/Authenticate Log Decrypt Decompress SOAP Extensions

Provide a mechanism to interact with processing Web service messages Specifically serialization and deserialization For example: Encyrypt/decrypt SOAP messages Transform messages before/after serialization/deserialization processes Log requests

WebServiceHandler Base class to Web service handlers WebServiceHandlerFactory handles delegation to correct handler WebServiceHandler SyncSessionlessHandler AsyncSessionlessHandler SyncSessionHandler AsyncSessionHandler

SOAP Extension Serialization/Deserialization HTTP Modules ASP.NET Web Service BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() WebMethod() Handler Factory Handler GetHandler() ProcessRequest() SOAP Extension BeforeDeserialize AfterDeserialize BeforeSerialize AfterSerialize

SOAP Extension Implementation Create an extension class that derives from SoapExtension Create attribute class that derives from SoapExtensionAttribute Configure the extension: For entire Web service in Web.config For specific method using extension attribute

SoapExtension Class Create a custom extension class, extend SoapExtension Class SoapExtension { public abstract object GetInitializer( Type serviceType ); public abstract object GetInitializer( LogicalMethodInfo methodInfo, SoapExtensionAttribute attribute ); public abstract void Initialize( object initializer ); public virtual Stream ChainStream( Stream stream ); public abstract void ProcessMessage( SoapMessage message ); }

SOAP Extension Workflow Web ServiceSOAP ExtensionASP.NET GetInitializer() Once per application Initialize() ChainStream() ProcessMessage() – Before Deserialize ProcessMessage() – After Deserialize [WebMethod] ChainStream() ProcessMessage() – Before Serialize ProcessMessage() – After Serialize Each method request

ProcessMessage() Access to SoapMessage at various serialization stages SOAP extensions on the Web server: On request, message is deserialized SoapMessageStage.BeforeDeserializeSoapMessageStage.AfterDeserialize On response, message is serialized: SoapMessageStage.BeforeSerializeSoapMessageStage.AfterSerialize

ProcessMessage() SOAP extensions on the Web client: On request, message is serialized SoapMessageStage.BeforeSerializeSoapMessageStage.AfterSerialize On response, message is deserialized: SoapMessageStage.BeforeDeserializeSoapMessageStage.AfterDeserialize

ChainStream() Provides access to the memory buffer of the SOAP request Do not have to override this, default behavior returns original stream Can return a new stream object for ASP.NET to reference public override Stream ChainStream( Stream stream ) { m_oldStream = stream; m_newStream = new MemoryStream(); return m_newStream; }

SOAP Extension Configuration Using XML configuration to invoke extension for all services within configuration scope Configure using SoapHeaderAttribute for individual methods

SOAP Extensions

Session Summary You learned about.NET support for configuring the HTTP pipeline You’ve seen some examples employing HTTP modules, handler factories and handlers You’ve seen where SOAP extensions fit in the pipeline for Web services

For More Information.NET Dashboard Resources IDesign Downloads

Attend a free chat or web cast List of newsgroups communities/newsgroups/en-us/default.aspx MS Community Sites Locate Local User Groups Community sites

Q1:Overall satisfaction with the session Q2:Usefulness of the information Q3:Presenter’s knowledge of the subject Q4:Presenter’s presentation skills Q5:Effectiveness of the presentation Please fill out a session evaluation on CommNet

Questions?

© 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.