c# - HttpModule 与 DelegatingHandler - 优点/缺点？

Question

我正在尝试在 ASP.NET WebAPI 项目中记录整个传入请求和传出响应。虽然我同意 DelegatingHandler，但我的雇主坚持使用 HttpModule。您如何向她解释为什么我们应该使用 DelegatingHandler 而不是 HttpModule？还是我错了？

Answer 1

我会使用 DelegatingHandler . DelegatingHandler是 Web API 管道的一部分，可以在任何主机下运行。 HttpModule 不是 Web Api 的一部分，需要 IIS。

虽然与您的问题没有直接关系，但我将引用以下内容 MSDN突出显示两者(包括差异)的文章:

HTTP Module This is an option for Web APIs running on IIS. HTTPmodules allow security code to execute early as part of the IISpipeline. The principal established from an HTTP module is availableto all components, including the IIS components running later in thepipeline. For example, when the principal is established by an HTTPmodule in response to the AuthenticateRequest event, the username ofthe principal gets logged correctly in the cs-username field in IISlogs. The biggest drawback with HTTP modules is the lack ofgranularity. HTTP modules run for all requests coming into theapplication. For a Web application with different capabilities such asHTML markup generation, Web APIs and so on, having an HTTP moduleenforcing authentication in one way is generally not a flexible-enoughapproach. Another disadvantage with using an HTTP module is thedependency on the host—IIS, in this case.

Message Handler An extensibility option provided by ASP.NET Web API,the greatest benefit in using a message handler for security is it’s aconcept of the ASP.NET Web API framework and, hence, doesn’t depend onthe underlying host or server. Also, a message handler runs only forWeb API requests. The downside of using a message handler is the lackof finer control. A message handler can be configured to run as aglobal handler for all requests or for a specific route. For a givenroute, you can have multiple controllers. All these controllers andthe action methods they contain must share the same authenticationenforced by the message handler configured for that route. In otherwords, the lowest granularity for authentication implemented by amessage handler is at the route level.