ASP.NET processes requests using a pipeline model which makes use of HttpModules and HttpHandlers to process all requests. When you configure your ASP.NET application to use an HttpModule you're effectively inserting that module into the request pipeline. This creates a scenario where each request must pass through all of the loaded HttpModules before it can get to the HttpHandler for the request. If you add ten HttpModules the request will have to pass through all ten modules before it gets to the HttpHandler.
By default, ASP.NET is configured to load several modules that you may or may not be using. I expected to find this in machine.config but on my machine it wasn't there, instead I located this setting in the WINDOWS\Microsoft.NET\Framework\$VERSION$\CONFIG\Web.Config file with the following entries:
1: <httpModules>
2: <add name="OutputCache" type="System.Web.Caching.OutputCacheModule"/>
3: <add name="Session" type="System.Web.SessionState.SessionStateModule"/>
4: <add name="WindowsAuthentication" type="System.Web.Security.WindowsAuthenticationModule"/>
5: <add name="FormsAuthentication" type="System.Web.Security.FormsAuthenticationModule"/>
6: <add name="PassportAuthentication" type="System.Web.Security.PassportAuthenticationModule"/>
7: <add name="RoleManager" type="System.Web.Security.RoleManagerModule"/>
8: <add name="UrlAuthorization" type="System.Web.Security.UrlAuthorizationModule"/>
9: <add name="FileAuthorization" type="System.Web.Security.FileAuthorizationModule"/>
10: <add name="AnonymousIdentification" type="System.Web.Security.AnonymousIdentificationModule"/>
11: <add name="Profile" type="System.Web.Profile.ProfileModule"/>
12: <add name="ErrorHandlerModule" type="System.Web.Mobile.ErrorHandlerModule, System.Web.Mobile, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
13: <add name="ServiceModel" type="System.ServiceModel.Activation.HttpModule, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
14: </httpModules>
Another way to determine this is to insert a little code into your application to iterate the currently loaded modules:
1: protected void Page_Load(object sender, EventArgs e)
2: { 3: StringBuilder sb = new StringBuilder();
4: foreach (string module in ApplicationInstance.Modules.Keys)
5: { 6: sb.Append(module);
7: sb.Append("<br/>"); 8: }
9: Response.Write(sb.ToString());
10:
11: }
It's likely that you don't need many of these modules. For example, if you're not making use of the ASP.NET Membership provider then you have an HttpModule sitting in your pipeline running some unneeded code on every request. It's generally not a good idea to change settings in machine.config or the root Web.Config but ASP.NET provides an easy way to override these settings. Modules loaded as a result of machine.config can be unloaded from your application by specifying in the <HttpModules> element of your web.config which modules to <remove>. Just be sure to only remove those items that you don't need.
1: <httpModules>
2: <remove name="FormsAuthenticationModule"/>
3: <remove name="WindowsAuthentication" />
4: <remove name="PassportAuthentication" />
5: <remove name="Profile" />
6: </httpModules>
Seems pretty simple, right? Well, that's because it is. This will likely not give you huge performance gains but considering each loaded HttpModule is executed during each and every request, every little bit will help.