Question

I have a problem with my Authentication HttpModule. The problem is that it obviously runs for every single request I get on my web server (IIS7). Because it also uses Session variable, it fails to work properly on CSS, JS files and similar.

I tried to use:

<add name="AuthModuleName" type="..." preCondition="managedHandler" />

but to no avail. It still runs on every request regardless of its extension or mime type. I should also add, there’s a setting

<modules runAllManagedModulesForAllRequests="true">

that seemed suspicious to me and actually disabled preConditions on modules. But changing it to false, breaks the application in a completely different way and with a different exception (The SessionStateTempDataProvider requires SessionState to be enabled).

Can anybody help me how to force IIS7 to exclude my HttpModule when requests are made for static content files?

Answer 1

runAllManagedModulesForAllRequests attribute has to be set to false to actually configure any module the way you want. You will have to also correctly reconfigure Session and others as needed, but the main thing is handlers pipeline execution order that handles requests.

The answer was provided in one of my other questions:

Thanks to Peter that provided the answer that worked correctly.