Introduction to Developing HTTP Modules in ASP.NET

Introduction
In ASP.NET, an HTTP Module is a class that implements the IHttpModule interface. By doing that it can listen to and handle events in the web request handling pipeline. They are the equivalent of 'ISAPI Filters' in IIS and 'Filters' in JSP. They are used for multiple purposes from authenticating a request to modifying the response and logging the request. In this tutorial, we will learn:

• Common uses of HTTP Modules
• Web Request Handling Pipeline
• Structure of an HTTP Module
• Creating your first HTTP Module

Common Uses of HTTP Modules
Following is a noncomprehensive list of common uses of HTTP Modules:

• Authentication - To authenticate a user. For example, you can place a cookie in the user's browser once he has logged in. Next time when the user visits the website, his session will have timed out. An HTTP Module can fetch the cookie and log the user back in by retrieving and matching the cookie string against user data in the database, without the user having to enter his username/password on the website. This can provide a smooth experience to the user who will never come to know how he has been logged back in automatically.
• Authorization - To protect access to restricted resources on the website. An HTTP Module can authenticate the user accessing the resource and if the user is not listed in the roles allowed to access this resource, then the user can be redirected back to a "login" page.
• Protection against Denial of Service Attacks - An HTTP Module can maintain an internal list of IP addresses accessing the website along with the hits the website is receiving from each of them. When an IP address is noted to be sending too many requests out of proportion to the rest of the IP addresses, that IP address can be temporarily blocked from accessing the website.
• HTTP Compression - To compress the text output of web pages using Gzip and Deflate algorithms. Compression can not only substantially reduce the bandwidth usage of a website, it can also make the pages appear faster in the users' browsers because of smaller sizes of compressed pages that are sent over the internet.
• Encryption - To encrypt an outgoing response into encrypted text.
• Caching - To cache commonly accessed content into an in-memory cache. This can be applied to static as well as dynamic generated content. Again an internal list can be used to gather statistics first as to which content is accessed more often than others. Then the popular content can be cached.
• Collecting User Information - To get the user IP address and match it against an internal database of IP addresses along with names of countries. The HTTP Module can then pass the fetched country name (or country code) silently to the request handlers which can then display it as a country flag to the user. This is useful for not only providing customized experience to the user, you can also use it to display different content (e.g., ads) to users from different countries.
• Modifying Headers - To modify the outgoing headers. For example, you can use it to tell the client browser when the requested resource was last modified and so on. You can send the headers for static content to be cached in the client browser and intermediate proxy servers, more often than for example dynamic content.
• Formatting Output - To transform XML files with XSL stylesheets on the fly. So when the user accesses an XML file on your website directly, he/she will be served an HTML transformation of the XML file, displaying the content in a more pleasant fashion.
• Replacing Content - To use regular expressions to parse and replace content in the response generated by the request handler. For example, to highlight words in the outgoing HTML content matching keywords that a user entered in the search engine e.g., Google, to visit your website. This will improve the experience of a person on your website who entered some keywords in Google and found your website among the ones that Google displayed. Now when he visited your website he sees his keywords highlighted within the text of that page.
• Logging - To log requests in a file or a database. Some examples:-
  • To log hits that your website is getting every hour. An ASP.NET page can be used to display these hits in a chart to you providing you with a quick snapshot of the activity on your website.
  • To scan the Status Code e.g., 500, generated by a resource downstream, and log it in the database. An ASP.NET page again can be used to view in the form of a chart, when and how many 500 HTTP errors were generated on the website and by which resource.
  • To log bandwidth that your website is using, day in and day out.

On the next page, we will look at the events in the 'Web Request Handling Pipeline'.