What is the correct usage of "runAllManagedModulesForAllRequests" in ASP.NET MVC2/3?

Question

I've read various posts and questions about the use of runAllManagedModulesForAllRequests in the modules section of <system.WebServer> and I'm concerned that I'm using this setting incorrectly.

All my ASP.NET MVC applications are written using .NET Framework 4.0 and MVC2, plus we have a beta of an application that uses MVC3.

These apps are deployed to servers running Windows 2008R2/IIS7.5. The sites are configured to run in Integrated Pipeline/.NET 4.0 application pools.

If I set runAllManagedModulesForAllRequests="false" then I get a HTTP Error 403.14 - Forbidden error from IIS. If I set this to true then all is well.

However this article suggests this is a bad thing to do and a fix:

Don't use runAllManagedModulesForAllRequests="true" when getting your MVC routing to work

Is it really that bad, should I follow this advice?

Kershaw

Microsoft came out with a hotfix (support.microsoft.com/kb/980368) if you don't want to set runAllManagedModulesForAllRequests. – Spector

@Ek0nomik - Yeah...and I know all about that hotfix :) - stackoverflow.com/questions/5078459 , stackoverflow.com/questions/5080837 . I even got a KB raised about the problems it caused: support.microsoft.com/kb/2620604 – Kershaw

Interesting. Thanks for sending along your research. I never use the Web.config for setting page specific authorization (I only use authorization attributes), so I haven't had any issues with the hotfix. – Spector

@Ek0nomik - those issues were related to classic ASP and ASP.NET Forms apps that the 980368 QFE broke, not MVC. MVC was fine. As a web hoster it caused us a headache or two. – Kershaw

Answer 1

How bad it is depends on the site traffic, if you are working on a high traffic website I'd say don't use it, and remove unneeded modules.

Murmansk

Having mulled this over for a day you're right. Fortunately most of the stuff I'm doing at the moment doesn't attract a massive amount of minute by minute traffic. – Kershaw