Samples: Trace IIS Requests and Responses

I'll be posting a series of samples on Filter.NET covering common uses one would give to an ISAPI Filter. Your comments and suggestions are welcome.

Trace Request

ISAPI filters have a series of events (11 to be exact), and these are all mapped into Filter.NET along with their properties. One such event is the native SF_NOTIFY_PREPROC_HEADERS which maps to the managed PreProcHeaders event.

The PreProcHeaders event is triggered by IIS when the HTTP headers have arrived (IIS reads TCP/IP packets until it sees a double CRLF), and allows an ISAPI Filter to view, change or remove headers. As such, this is an excellent opportunity for an ISAPI to trace the incoming request headers.

During this event, we not only have access to all request headers sent, but we also have access to the server variables which IIS makes available containing much more useful information. ALL_RAW is one of them, with all headers sent in the request.

I think its time we give it a try then:

using System;
using System.Diagnostics;
using KodeIT.Web;

namespace FilterDotNet.Samples
{
    class TraceRequest : IHttpFilter
    {
        void IHttpFilter.Init(IFilterEvents events)
        {
            events.PreProcHeaders += new EventHandler(OnPreProcHeaders);
        }

        void OnPreProcHeaders(object sender, PreProcHeadersEventArgs e)
        {
            RequestHeadersEvent context = e.Context;
            string requestHeaders = String.Format("{0} {1} {2}\r\n{3}",
                context.Method,
                context.Url,
                context.Version,
                context.ServerVariables[ServerVariable.ALL_RAW]);

            Trace.WriteLine(requestHeaders);
        }

        void IHttpFilter.Dispose() { }
    }
}

Looks simple, right?

To install the sample, just register the assembly on Filter.NET configuration file - KodeIT.Web.dll.config - reset IIS and you're done. Open up DebugView from Microsoft (formerly SysInternals), make a request to IIS and watch ...

Trace Response

No, I didn't forget about the http response :) Neither did IIS, and thats why there is an event useful for just that, to retrieve the full http response sent by IIS. The native event is SF_NOTIFY_SEND_RAW_DATA and the managed event is SendRawData.

When this event is triggered, IIS presents us with an array of bytes that will be sent to the client, and we can view and change those bytes. Right now, we're just interested in viewing them, so lets do exactly that:

using System;
using System.Diagnostics;
using System.Text;
using KodeIT.Web;

namespace FilterDotNet.Samples
{
    class TraceResponse : IHttpFilter
    {
        void IHttpFilter.Init(IFilterEvents events)
        {
            events.SendRawData += new EventHandler(OnSendRawData);
        }

        void OnSendRawData(object sender, RawDataEventArgs e)
        {
            Trace.WriteLine(ASCIIEncoding.ASCII.GetString(e.Context.GetData()));
        }

        void IHttpFilter.Dispose() { }
    }
}

This can also be part of the first managed filter instead of being a separate one. Again, compile it, register it, open DebugView, make a request to IIS and watch the responses sent by IIS.