VietMX Staff asked 3 years ago
- HTTP Module – This is an option for Web APIs running on IIS. HTTP modules allow security code to execute early as part of the IIS pipeline. The principal established from an HTTP module is available to all components, including the IIS components running later in the pipeline.
- Message Handler – An extensibility option provided by ASP.NET Web API, the greatest benefit in using a message handler for security is it’s a concept of the ASP.NET Web API framework and, hence, doesn’t depend on the underlying host or server. Also, a message handler runs only for Web API requests. The downside of using a message handler is the lack of finer control.
The DelegatingHandler is part of the Web API pipeline and can run under any host. HttpModule is not part of Web Api and requires IIS.
