ASP.NET 2.0 HttpModule or HttpHandler

Question

I'm improving an app for authentication/authorization. The app is asp but I'm pretty unfamiliar with it.

So far I have been able to create a HttpModule and HttpHandler and register them in the IIS Manager.

First I have tried an HttpModule and had success with doing the AA with the module run on managed resources. I'm using the PreRequestHandlerExecute method so I have access to session. For some reason when other pages run pieces like menus begin to go missing. In the module code I have have simply put a variable in session. why does this happen?

Next I have tried an HttpHandler for a specific path. I seemed to have luck there but then the actual login form post submit causes an error. Probably because the form is runat server and it sees something session etc bad because of the handler being in front of it.

If I remove the HttpModule/HttpHandler the app works just fine but obviously does not have the AA needed. So I'm missing key parts to using HttpModule/HttpHandler

I've already ran across many common issues like null session etc. that I have resolved.

I've done this type of work in Java Server/Jsp using Filter/FilterChain many times but ASP.NET is simply too new to me to figure out the API/Syntax.

I need to find the simplest way to add an HttpModule/HttpHandler that can work with the existing form login but allow me to do some AA and do a redirect or session management for AA. I've considered just using scripting <% %> etc in the aspx page.

Any suggestions appreciated.

Answer 1

An HttpModule will be hit on every request. A HttpHandler is usually run on a specific extension.

Generally for authentication, you'll want it in a module, since you'll want to examine every request to see if it's authenticated.