46

I've read various posts and questions about the use of runAllManagedModulesForAllRequests in the modules section of <system.WebServer> and I'm concerned that I'm using this setting incorrectly.

All my ASP.NET MVC applications are written using .NET Framework 4.0 and MVC2, plus we have a beta of an application that uses MVC3.

These apps are deployed to servers running Windows 2008R2/IIS7.5. The sites are configured to run in Integrated Pipeline/.NET 4.0 application pools.

If I set runAllManagedModulesForAllRequests="false" then I get a HTTP Error 403.14 - Forbidden error from IIS. If I set this to true then all is well.

However this article suggests this is a bad thing to do and a fix:

Don't use runAllManagedModulesForAllRequests="true" when getting your MVC routing to work

Is it really that bad, should I follow this advice?

adrianbanks
  • 81,306
  • 22
  • 176
  • 206
Kev
  • 118,037
  • 53
  • 300
  • 385
  • 1
    Microsoft came out with a hotfix (http://support.microsoft.com/kb/980368) if you don't want to set `runAllManagedModulesForAllRequests`. – Justin Helgerson Mar 12 '12 at 15:04
  • @Ek0nomik - Yeah...and I know all about that hotfix :) - http://stackoverflow.com/questions/5078459 , http://stackoverflow.com/questions/5080837 . I even got a KB raised about the problems it caused: http://support.microsoft.com/kb/2620604 – Kev Mar 12 '12 at 16:08
  • Interesting. Thanks for sending along your research. I never use the Web.config for setting page specific authorization (I only use authorization attributes), so I haven't had any issues with the hotfix. – Justin Helgerson Mar 12 '12 at 16:44
  • @Ek0nomik - those issues were related to classic ASP and ASP.NET Forms apps that the 980368 QFE broke, not MVC. MVC was fine. As a web hoster it caused us a headache or two. – Kev Mar 12 '12 at 17:08

1 Answers1

11

How bad it is depends on the site traffic, if you are working on a high traffic website I'd say don't use it, and remove unneeded modules.

Max Toro
  • 28,282
  • 11
  • 76
  • 114
  • Having mulled this over for a day you're right. Fortunately most of the stuff I'm doing at the moment doesn't attract a massive amount of minute by minute traffic. – Kev Dec 31 '10 at 17:41