Considering OWIN middleware and security enhancements for .NET

Thanks for getting back to me.

We would definitely be interested in OWIN support. Most of our stuff is headed to OWIN and ASP.NET 5. I’ll have to do some research to see if I can better quantify it and get some issues filed so we can work on PRs.

I see what you’re saying on the policy-based security thing. That could probably be a custom piece. If we come up with something that looks like it could be interesting or generally useful we could always offer it up in a PR.

Something in that which may be breaking is that there are ties to System.Web, System.Data, and other non-portable things from the core MiniProfiler package. None of that will work in ASP.NET 5 and/or OWIN (self) hosting. Making the common bits portable across the different platforms would be really valuable, but I can see that breaking the assembly up that way - such that only core data structures are in the core and everything platform-specific including even the basic SQL profiling and legacy ASP.NET profiling support would be in separate assemblies - could be a fairly large shift.

The Web API challenges we’re looking at are for things like OWIN and self-hosting. There’s no HttpContext so having a mechanism to store context in HttpRequestMessage or OwinContext rather than HttpContext is what we’d be looking for. Probably the OWIN middleware solution would be able to address that, standardizing everything on OwinContext. I could see that fairly easily being a separate package.

I also didn’t see for REST calls where there was any hook into HttpClient like there is for WCF calls such that you can profile downstream REST calls from one app to another. Maybe I missed that. That’s definitely something we’d want.

Anyway, thanks again for getting back to me. I’ll talk to my team and see how we want to proceed. If you see anything in here so far that sounds like it may not work out, do let me know.