The image resizer is implemented as an HttpModule. URL authorization is performed by .NET prior to any URL rewriting, and also by the image resizer afterwards. This ensures no holes in URL authorization are created.
For best performance, *all* file serving work is done by IIS. The cached image is first written to disk, allowing a simple RewritePath call to pass the work to IIS. This eliminates all the threads that would otherwise be hanging around, using memory.
The same code can now be used for both IIS5, 6, 7 classic and 7 integrated. The httpModules section handles IIS5/6/7c, and the modules section handles IIS7 integrated mode.
<system.web>
...
<httpModules>
<add name="ImageResizer" type="fbs.ImageResizer.InterceptModule"/>
</httpModules>
...
</system.web>
<system.webServer>
<validation validateIntegratedModeConfiguration="false"/>
...
<modules>
<add name="ImageResizer" type="fbs.ImageResizer.InterceptModule"/>
</modules>
</system.webServer>