Can I be sure that HttpModules are executed in the order in which they are listed in the HttpApplication.Modules collection?

Question

I want to write an IHttpModule that has to be executed strictly after FormsAuthenticationModule, otherwise it will be useless.

There's HttpContext.Current.ApplicationInstance.Modules property that returns a collection of IHttpModules. I can check that my module is after FormsAuthenticationModule in this collection.

Will that be enough? Does that collection list IHttpModules in the order in which they are executed?

Answer 1

Recall that modules can subscribe to different pipeline events. Within any given pipeline event, modules should run in the order in which they're specified in the Modules collection.

As a practical example, imagine a Modules collection which has these three modules registered:

• Module A, which subscribes to EndRequest
• Module B, which subscribes to BeginRequest and EndRequest
• Module C, which subscribes to AuthenticateRequest

The order of execution will be:

1. Module B, BeginRequest
2. Module C, AuthenticateRequest
3. Module A, EndRequest
4. Module B, EndRequest

Since the FormsAuthenticationModule subscribes to the AuthenticateRequest event, consider making your own module subscribe to the PostAuthenticateRequest event. That way you're guaranteed that if the FormsAuthenticationModule logic runs, it runs before your logic, regardless of the order in which they're registered in the Modules collection.

Answer 2

I will try to answer it .

I do not think you should rely on HttpContext.Current.ApplicationInstance.Modules collection, because you do now in which order module will be executed.

Please note that I did't do any prototype, it's just my thought .

The dll Microsoft.Web.Infrastructure.dll has a method for register dynamically HTTP module

The dll is shipped with WebPages 1.0

Create helper class for registration

public static class RegisterHttpModuleHelper
{

    public static void Start()
    {

        DynamicModuleUtility.RegisterModule(typeof(YourCustomModule));
    }
}

FormsAuthenticationModule has event "Authenticate".

On hander of this event , try to dynamicaly register your Custom HttpModule using

public void FormsAuthentication_OnAuthenticate(object sender, FormsAuthenticationEventArgs args)
{
    RegisterHttpModuleHelper.Start()
}