An update on runAllManagedModulesForAllRequests.

I talked about disabling the runAllManagedModulesForAllRequests setting in your web.config before. It seems that the story is a little bit more complex then I thought. Rick Strahl’s wrote a great article about some of the caveats of with the runAllManagedModulesForAllRequests in IIS 7/8.

He mentions that setting the runAllManagedModulesForAllRequests=”false”  has a different behavior as I originally expected. I expected that non-ASP.NET requests no longer passes through the ASP.NET Module pipeline. But that's not what actually happens.

Rick gave the following sample:

If you create a module like this:

<add name="SharewareModule" type="HowAspNetWorks.SharewareMessageModule"  />

by default it will fire against ALL requests regardless of the runAllManagedModulesForAllRequests flag. Even if the value runAllManagedModulesForAllRequests="false", the module is fired with unmanaged requests going through it.

So what is the runAllManagedModulesForAllRequests really good for? It's essentially an override for managedHandler preCondition. If you declare your handler in web.config like this:

<add name="SharewareModule" type="HowAspNetWorks.SharewareMessageModule" 
           preCondition="managedHandler" />

and then set runAllManagedModulesForAllRequests="false" your module only fires against managed requests. If you switch the flag to true, now your module ends up handling all IIS requests that are passed through from IIS.
 

So what do we need to remember?

You should always set the preCondition="managedHandler" attribute to ensure that only managed requests are fired on this module. But even if you do this, realize that runAllManagedModulesForAllRequests="true" can override this setting, so your module has to anticipate handling any kind of request.


Thanks Rick for this useful information!