Any language that has an "eval" mechanism makes this really easy. I've used Groovy's GroovyScriptEngine to build something like what you're describing. These scripts are provided with a "Binding" that gives the script access to the HttpRequest and HttpResponse.