1. DEV410 Inside the ASP.NET Runtime - Intercepting HTTP Requests Michele Leroux Bustamante Principal Software Architect IDesign Inc.

2. Speaker BIO Principal Software Architect, IDesign, www.idesign.net www.idesign.net Microsoft Regional Director, www.microsoft.com/rd www.microsoft.com/rd Microsoft MVP – XML Web Services INETA Speaker’s Bureau BEA Technical Director Web Services Program Advisor, UCSD Blog: www.dasblonde.net

3. What we will cover: How IIS passes requests to ASP.NET How to configure the ASP.NET pipeline to intercept requests, and why you’d want to How to create useful custom pipeline components HTTP Modules Handler Factories and Handlers SOAP Extensions

4. Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

5. IIS & ASP.NET Runtime Configuration IIS passes HTTP requests to ASP.NET through an unmanaged ISAPI extension This is the “hook” between IIS and the ASP.NET HTTP runtime Resource extensions are configured in IIS to be handled by ASP.NET Default configuration excludes *.xml, *.html, graphic file extensions and more

6. IIS & ASP.NET Runtime Configuration.NET extensions are configured to be handled by aspnet_isapi.dll

7. IIS & ASP.NET Request Workflow IIS ASP.NET Runtime Application HTTP Response asp.dll aspnet_isapi.dll *.asp *.asmx HTTP Request Process Request Web.config Machine.config

8. ASP.NET Configuration Machine.config Machine.config defines default handlers or handler factories to manage requests

9. ASP.NET Configuration Web.config Web.config may alter Machine.config settings at the application level HTTP Handlers can be chosen by: Verb: POST/GET Path: by extension, by specific URL

10. IIS & ASP.NET Request Workflow IIS ASP.NET Runtime Application HTTP Response asp.dll aspnet_isapi.dll *.asp *.asmx HTTP Request Process Request Web.config Machine.config IHttpHandlerFactory IHttpHandler

11. IIS 5.0 and ASP.NET Inetinfo.exe aspnet_isapi.dll aspnet_wp.exe IIS 5.0ASP.NET Application Domain HttpHandler Thread Pool Pooled HttpApplication HttpModules

12. IIS 6.0 and ASP.NET http.sys IIS 6.0ASP.NET inetinfo.exe aspnet_wp.exe w3wp.exe Application Domain HttpHandler

13. HTTP Pipeline Components Configurable components: HTTP Handler Factories HTTP Handlers HTTP Modules SOAP Extensions Use individually, or combined Configure per application, or globally

14. IIS ASP.NET Runtime Pipeline Components Page Request HTTP Request HTTP Handler Factory HTTP Handler/Page ASPNET_ISAPI.DLL HTTP Response HTTP Modules

15. IIS ASP.NET Runtime Pipeline Components Web Method Request HTTP Request HTTP Handler Factory HTTP Handler/ WebServicesHandler Web Service Method ASPNET_ISAPI.DLL HTTP Response HTTP Modules SOAP Extension

16. Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

17. HTTP Modules Leverage an event-driven model to interact with Web applications Can interact with every HTTP request Useful for: Custom authorization Global error handler Implementing caching or other utilities Request diagnostics

18. HTTP Modules WindowsAuthenticationModuleFormsAuthenticationPassportAuthenticationModuleFileAuthorizationModuleUrlAuthorizationModuleSessionStateModule

19. HTTP Modules Configuration Configured in Configured in Instantiated in order configured Intercept events before the application object (global.asax) receives them … …

20. HTTP Modules IHttpModule Modules implement IHttpModule Interface IHttpModule { void Init( HttpApplication context ); void Dispose(); }

21. HTTP Modules Initialization Register for events during Init() protected void Init() { application.PreRequestHandlerExecute += (new EventHandler(this.Application_PreRequestHandlerExecute)); application.PostRequestHandlerExecute += (new EventHandler(this.Application_PostRequestHandlerExecute)); }

22. HTTP Modules Event Handlers Events based on EventHandler delegate Access to HttpApplication object Can also publish events to listening applications within the module’s scope private void Application_PreRequestHandlerExecute(Object source, EventArgs e) { HttpApplication app = (HttpApplication)source; }

23. HTTP Modules Application Events HTTP Modules ASP.NET Page Resource BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() HTTP GET somepage.aspx

24. HTTP Module

25. Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

26. HTTP Handler Factories & HTTP Handlers Components configured to handle requests for specific resources HTTP handler factories return an HTTP handler to process the request Or, you can configure the HTTP handler directly Useful for: Intercepting requests for specific resources Overriding how requests are processed Formatting requests for custom types

27. HTTP Handler Factories System.Web.UI.PageHandlerFactorySystem.Web.Services.Protocols.WebServiceHandlerFactorySystem.Runtime.Remoting.Channels.Http.HttpRemotingHandlerFactory

28. HTTP Handler Factories Configuration Register in Register in Can override in application Web.config

29. HTTP Handler Factories IHttpHandlerFactory Implement IHttpHandlerFactory GetHandler() Returns IHttpHandler type Can access HttpContext and related info ReleaseHandler()Cleanup! interface IHttpHandlerFactory { IHttpHandler GetHandler( HttpContext context, string requestType, string url, string pathTranslated ); void ReleaseHandler( IHttpHandler handler ); }

30. HTTP Handler Factory Page Request HTTP Modules ASP.NET Page Resource BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() HTTP GET somepage.aspx Handler Factory Handler GetHandler() ProcessRequest()

31. HTTP Handler Factory Web Service Method HTTP Modules ASP.NET Web Service BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() WebMethod() Handler Factory Handler GetHandler() ProcessRequest()

32. HTTP Handlers System.Web.HttpForbiddenHandlerSystem.Web.StaticFileHandlerSystem.Web.HttpMethodNotAllowedHandlerSystem.Web.Handlers.TraceHandlerSystem.Web.UI.Page

33. HTTP Handlers Configuration Can directly configure IHttpHandler instead of IHttpHandlerFactory Factory used when specific handler may vary per request specifics

34. HTTP Handlers IHttpHandler Implement IHttpHandler ProcessRequest() Invoked by HttpRuntime Handle the request accordingly IsReusable If resource can be shared, return true Interface IHttpHandler { void ProcessRequest(HttpContext context ); bool IsReusable {get;} }

35. HTTP Handler Factories & Handlers

36. HTTP Handlers Accessing Session To access Session from a custom handler, implement marker interface, IRequiresSessionState class CustomHandler: IHttpHandler, IRequiresSessionState { public void ProcessRequest(HttpContext context ) { object somdData = context.Session[“data”]; … } public bool IsReusable { get { return true;} }

37. HTTP Handlers Asynchronous Handlers Asynchronous design pattern Offloads request to a new thread Frees thread from the application thread pool for better performance Limited gains without scalable architecture interface IHttpAsyncHandler : IHttpHandler { IAsyncResult BeginProcessRequest( HttpContext context, AsyncCallback cb, object extraData ); void EndProcessRequest(IAsyncResult result ); }

38. HTTP Handlers *.ASHX Handlers may be defined in an.ashx file Flexible, lightweight implementation No IIS configuration required With or without code-behind public class MyCustomHandler: IHttpHandler {…}

39. Agenda IIS & ASP.NET Configuration HTTP Modules HTTP Handler Factories and HTTP Handlers SOAP Extensions

40. Message Serialization ASP.NET uses XmlSerializer to serialize/deserialize SOAP messages Web Service Client Application Web Method SOAP Request XML Serialize Deserialize Parameters Return Value SOAP Response XML Client Proxy Parameters Return Value Serialize Deserialize

41. IIS ASP.NET Runtime SOAP Extensions HTTP Request Web Service Method ASPNET_ISAPI.DLL HTTP Response Validate/Transform Authorize/Authenticate Log Decrypt Decompress SOAP Extensions

42. Provide a mechanism to interact with processing Web service messages Specifically serialization and deserialization For example: Encyrypt/decrypt SOAP messages Transform messages before/after serialization/deserialization processes Log requests

43. WebServiceHandler Base class to Web service handlers WebServiceHandlerFactory handles delegation to correct handler WebServiceHandler SyncSessionlessHandler AsyncSessionlessHandler SyncSessionHandler AsyncSessionHandler

44. SOAP Extension Serialization/Deserialization HTTP Modules ASP.NET Web Service BeginRequest() AuthenticateRequest() AuthorizeRequest() ResolveRequestCache() AcquireRequestState() PreRequestHandlerExecute() EndRequest() UpdateRequestCache() ReleaseRequestState() PostRequestHandlerExecute() WebMethod() Handler Factory Handler GetHandler() ProcessRequest() SOAP Extension BeforeDeserialize AfterDeserialize BeforeSerialize AfterSerialize

45. SOAP Extension Implementation Create an extension class that derives from SoapExtension Create attribute class that derives from SoapExtensionAttribute Configure the extension: For entire Web service in Web.config For specific method using extension attribute

46. SoapExtension Class Create a custom extension class, extend SoapExtension Class SoapExtension { public abstract object GetInitializer( Type serviceType ); public abstract object GetInitializer( LogicalMethodInfo methodInfo, SoapExtensionAttribute attribute ); public abstract void Initialize( object initializer ); public virtual Stream ChainStream( Stream stream ); public abstract void ProcessMessage( SoapMessage message ); }

47. SOAP Extension Workflow Web ServiceSOAP ExtensionASP.NET GetInitializer() Once per application Initialize() ChainStream() ProcessMessage() – Before Deserialize ProcessMessage() – After Deserialize [WebMethod] ChainStream() ProcessMessage() – Before Serialize ProcessMessage() – After Serialize Each method request

48. ProcessMessage() Access to SoapMessage at various serialization stages SOAP extensions on the Web server: On request, message is deserialized SoapMessageStage.BeforeDeserializeSoapMessageStage.AfterDeserialize On response, message is serialized: SoapMessageStage.BeforeSerializeSoapMessageStage.AfterSerialize

49. ProcessMessage() SOAP extensions on the Web client: On request, message is serialized SoapMessageStage.BeforeSerializeSoapMessageStage.AfterSerialize On response, message is deserialized: SoapMessageStage.BeforeDeserializeSoapMessageStage.AfterDeserialize

50. ChainStream() Provides access to the memory buffer of the SOAP request Do not have to override this, default behavior returns original stream Can return a new stream object for ASP.NET to reference public override Stream ChainStream( Stream stream ) { m_oldStream = stream; m_newStream = new MemoryStream(); return m_newStream; }

51. SOAP Extension Configuration Using XML configuration to invoke extension for all services within configuration scope Configure using SoapHeaderAttribute for individual methods

52. SOAP Extensions

53. Session Summary You learned about.NET support for configuring the HTTP pipeline You’ve seen some examples employing HTTP modules, handler factories and handlers You’ve seen where SOAP extensions fit in the pipeline for Web services

54. For More Information.NET Dashboard Resources http://www.dotnetdashboard.net/Sessions/handlers.aspxhttp://www.dotnetdashboard.net/Sessions/soapext.aspx IDesign Downloads http://www.idesign.net

55. Attend a free chat or web cast http://www.microsoft.com/communities/chats/default.mspx http://www.microsoft.com/usa/webcasts/default.asp List of newsgroups http://communities2.microsoft.com/ communities/newsgroups/en-us/default.aspx MS Community Sites http://www.microsoft.com/communities/default.mspx Locate Local User Groups http://www.microsoft.com/communities/usergroups/default.mspx Community sites http://www.microsoft.com/communities/related/default.mspx

56. Q1:Overall satisfaction with the session Q2:Usefulness of the information Q3:Presenter’s knowledge of the subject Q4:Presenter’s presentation skills Q5:Effectiveness of the presentation Please fill out a session evaluation on CommNet

57. Questions?

58. © 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.