Can a NET 6 Middleware execution order be specified to run earlier in IIS lifecycle

Question

I have a.NET 6 web app that is running on an IIS server. The server is configured to use IIS HTTPModules which perform logic for every application on the site and hook in the typical events such as BEGIN_REQUEST() and POST_AUTHENTICATE().

I am aware that.NET 6 does not use that same event handle pattern and, in our scenario the IIS pipeline/lifecycle runs separately than the.NET 6 pipeline/lifecycle.

I have read through the middleware documentation and have implemented previous middleware components. I am trying to understand where in the classic ASP.NET pipeline the.NET 6 Middleware kicks in. From what I can tell the.NET 6 middleware execution order occurs sometime after the POST_AUTHENTICATE which is too late for my logic.

Can a middleware component can be ordered and injected into the HTTP request at the level of the BEGIN_REQUEST or at least prior to POST_AUTHENTICATE?

Answer 1

What prevents you from changing the execution order is that ASP.NET Core module hooks itself to IIS RQ_EXECUTE_REQUEST_HANDLER event, as showed in source code . ASP.NET Core runtime is then initialized by this module, and all middleware code executes afterward. So for you, this can be not early enough.

You can read IIS reference 1/2 to learn more about the events.

However, the decision to hook to this event was made due to a variety of reasons, both feature-wide and compatibility-wide.

So, in your case you should be able to choose from the options below,

• Move your logic to a .NET Framework 4.x module or a native IIS module so that this custom module hooks to an earlier event.

  You can share data if needed between the custom module and your ASP.NET Core middleware, though clearly that boundary crossing isn't easy.

• Build your own ASP.NET Core module to hook to whatever event you like, by modifying the source code.

  But this is a huge decision to make because on that path you need to maintain a fork and track actively on security patches. Moving the event hook can also break some ASP.NET Core features as they might not be designed to run early.

References

• ASP.NET Core module source code
• IIS reference 1
• IIS reference 2