Adding Custom IHttpModule to web.config throws 500 error

I have been struggling with this very basic issue all day. Long term I am trying to keep .NETs Forms Authentication, but replace the default Authorization module with a custom one.

However, before I get there, I just need my custom IHttpModule to get called.

I copied this code off of the net as a basic template to get started:

public class UrlAuthorizationModule : IHttpModule
{
    public void Init(HttpApplication context)
    {
        context.AuthenticateRequest += new EventHandler(context_AuthenticateRequest);
        context.AuthorizeRequest += new EventHandler(context_AuthorizeRequest);
    }

void context_AuthenticateRequest(object sender, EventArgs e)
{
    var sting = "";
}
void context_AuthorizeRequest(object sender, EventArgs e)
{
    HttpApplication context = (HttpApplication)sender;

    if (context.Request.Url.AbsoluteUri.Contains("Oregon"))
        return;
    else
        throw new UnauthorizedAccessException();

    //if (context.User != null && context.User.Identity.IsAuthenticated)
    //{
    //    HttpContext _httpContext = context.Context;
    //    SiteMapNode node = SiteMap.Provider.FindSiteMapNode(_httpContext);
    //    if (node == null)
    //        throw new UnauthorizedAccessException();
    //}
}

public void Dispose()
{
}
}

And I put this into the web.config:

  <system.web>
    <httpModules>
      <remove name="UrlAuthorization" />
      <add name="UrlAuthorizationModule" type="MyNamespace.UrlAuthorizationModule, common" />

However it was not getting called at all. Nothing was happening. Then I realized that I was probably using iis7, so I added this:

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true">
      <remove name="UrlAuthorization" />
      <add name="UrlAuthorizationModule" type="MyNamespace.UrlAuthorizationModule, common" />
  <add type="DevExpress.Web.ASPxHttpHandlerModule, DevExpress.Web.v17.2, Version=17.2.5.0, Culture=neutral, PublicKeyToken=B88D1754D700E49A" name="ASPxHttpHandlerModule" />

Unfortunately, as soon as I add the "add" customtag inside the system.webServer/modules then the site will not load at all. Instead it throws a generic 500 error.

Server Error

500 - Internal server error.

There is a problem with the resource you are looking for, and it cannot be displayed.

As near as I can tell my syntax is all correct. The DevExpress custom module is working correctly and no errors get thrown because of it, so I know it is my additions that are causing problems. If I delete my "add" line then the site loads correctly, it just does not call my custom IHttpModule.

Nothing is showing up in the System log either. It has got to be something really stupid, I just do not see it.

EDIT: I am using Microsoft Visual Studio 2017 (which uses IISExpress) on my local win 10 dev machine. I did find some TraceLogFiles at: C:\Users\username\Documents\IISExpress\TraceLogFiles\website\fr000001.xml and inside that was this error.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
 <System>
  <Provider Name="WWW Server" Guid="{3A2A4E84-4C21-4981-AE10-3FDA0D9B0F83}"/>
  <EventID>0</EventID>
  <Version>1</Version>
  <Level>3</Level>
  <Opcode>16</Opcode>
  <Keywords>0x100</Keywords>
  <TimeCreated SystemTime="2018-11-13T15:25:30.609Z"/>
  <Correlation ActivityID="{80001795-0008-FD00-B63F-84710C7967BB}"/>
  <Execution ProcessID="41168" ThreadID="40824"/>
  <Computer>machine name</Computer>
 </System>
 <EventData>
  <Data Name="ContextId">{80001795-0008-FD00-B63F-84710C7967BB}</Data>
  <Data Name="ModuleName">IIS Web Core</Data>
  <Data Name="Notification">1</Data>
  <Data Name="HttpStatus">500</Data>
  <Data Name="HttpReason">Internal Server Error</Data>
  <Data Name="HttpSubStatus">19</Data>
  <Data Name="ErrorCode">2147942433</Data>
  <Data Name="ConfigExceptionInfo">\\?\C:\Users\username\Documents\websitepath\web.config ( 394) :Lock violation
</Data>
 </EventData>
 <RenderingInfo Culture="en-US">
  <Opcode>MODULE_SET_RESPONSE_ERROR_STATUS</Opcode>
  <Keywords>
   <Keyword>RequestNotifications</Keyword>
  </Keywords>
  <freb:Description Data="Notification">BEGIN_REQUEST</freb:Description>
  <freb:Description Data="ErrorCode">The process cannot access the file because another process has locked a portion of the file.
 (0x80070021)</freb:Description>
 </RenderingInfo>
 <ExtendedTracingInfo xmlns="http://schemas.microsoft.com/win/2004/08/events/trace">
  <EventGuid>{002E91E3-E7AE-44AB-8E07-99230FFA6ADE}</EventGuid>
 </ExtendedTracingInfo>
</Event>

As near as I can tell, it is complaining that the web.config file is being locked by another process. But that does not make sense. Just to be safe I changed the dev port I was working on to a new random number from the old random number I was using, and it had no affect. Considering the site works without the custom module, that means the web.config files base permissions are ok.

I managed to find the answer in this post.

For some reason, the "remove" tag inside of modules:

<modules runAllManagedModulesForAllRequests="true">
  <remove name="UrlAuthorization" />
</modules>

is not allowed inside of system.webServer anymore. And the error thrown is not super great. As soon as I removed that tag (leaving the two custom add tags) the site started at least displaying again.

This post pointed me to the applicationhost.config file where I was able to modify $(solutionDir).vs\config\applicationhost.config

<add name="UrlAuthorizationModule" lockItem="true" />

and replace it with

<add name="UrlAuthorizationModule" lockItem="false" />

Then I was able to use the remove tag in my local web.config successfully.

<modules runAllManagedModulesForAllRequests="true">
  <remove name="UrlAuthorizationModule" />
</modules>