Tuesday, September 05, 2006
Web Service Specifications
To start with, take a look at the List of Web Service Specifications.
A list of Web Service Specifications on MSDN.
Also read the article : Security in a Web Services World: A Proposed Architecture and Roadmap - A Joint White Paper from IBM Corporation and Microsoft Corporation
A list of Web Service Specifications on MSDN.
Also read the article : Security in a Web Services World: A Proposed Architecture and Roadmap - A Joint White Paper from IBM Corporation and Microsoft Corporation
Wednesday, November 23, 2005
ReadOnly Textboxes not preserving value in ASP.NET
I just came across a behaviour in ASP.NET 2.0 which is a breaking change between the previous versions.
The MSDN Documentation mentions it as follows:-
Important:
The Text value of a TextBox control with the ReadOnly property set to true is sent to the server when a postback occurs, but the server does no processing for a read-only text box. This prevents a malicious user from changing a Text value that is read-only. The value of the Text property is preserved in the view state between postbacks unless modified by server-side code.
However I had a lot of code in my current application which uses the Text value of the control when it is ReadOnly.
So I wrote the following workaround in my PageBase class which is the base class for all Pages of my application:-
The MSDN Documentation mentions it as follows:-
Important:
The Text value of a TextBox control with the ReadOnly property set to true is sent to the server when a postback occurs, but the server does no processing for a read-only text box. This prevents a malicious user from changing a Text value that is read-only. The value of the Text property is preserved in the view state between postbacks unless modified by server-side code.
However I had a lot of code in my current application which uses the Text value of the control when it is ReadOnly.
So I wrote the following workaround in my PageBase class which is the base class for all Pages of my application:-
protected override void OnLoad(EventArgs e)
{
SetReadOnlyTextBoxValue(Page.Controls);
base.OnLoad (e);
}
///
/// In ASP.NET 2.0, if the TextBox is ReadOnly,
/// then any changes made to it using javascript are not retained.
/// This was not the case for ASP 1.1.
/// This function overrides the behaviour by re-assigning
/// the values of the textboxes by collecting it from Request
///
///
private void SetReadOnlyTextBoxValue(ControlCollection ctrls)
{
if (ctrls != null)
{
foreach (Control ctrl in ctrls)
{
if (ctrl.HasControls())
{
SetReadOnlyTextBoxValue(ctrl.Controls);
}
TextBox txt = ctrl as TextBox;
if (txt != null && txt.ReadOnly && Request.Form[txt.ID] != null)
{
txt.Text = Request.Form[txt.ID];
}
}
}
}
Monday, November 07, 2005
Web Deployment Projects
Project files are back for web projects in VS 2005!
http://blogs.msdn.com/anutthara/archive/2005/10/20/483091.aspx
That's almost true .... :) Last week I was involved with testing an add in that the ASP.NET team was working on - it is called "Web deployment projects". This is an add in that will be shipped about the same time as VS 2005. Having used VS 2003 back in school, when I joined MSFT after graduating, I was a little unsettled at the thought of having web "projects" without project files! In the course of 2 years, I became used to this model though the pain of not having a project file would surface now and then.
With this add in, you can now associate any web app with a web deployment project that is nothing but an MSBuild project file. It is as easy as a right click + add. The web deployment project can be configured to built in various configurations and can automatically deploy your website on an IIS server (pretty cool from a Team Build perspective too). This comes integrated with the Asp_merge tool that can actually compile your web project into a single dll with a sane name (compare against the App32435435__90blah blah.dll that is auto generated now) or separate dlls per folder or per page. You can also replace sections of your web.config file in a simple UI to override specific settings. Strong name signing is also built into this UI along with options for delay signing. Of course, since this is an MSBuild project file, it is highly extensible and stubs are already provided in the project file to override and add custom tasks.
Undoubtedly, the feature I liked best was the IIS deployment feature, where you can choose the virtual directory to deploy to and also opt to delete pre-existing directories or not. The coolth of it is the integration it brings to Team Build web testing scenarios. Users that run web tests on web apps built in Team Build need to deploy the app on the IIS server on the build machine. There was no out of the box solution for this and it involved having to write custom tasks in order to deploy the web app. Now, all we need to do is include the deployment project in the team project to build, and lo - the web tests can run with no custom tasks in between.
I was pretty charmed by this add in, so much that I wondered why this wasn't part of the product itself ;-)
Let me know what you think of the web deployment project add in when you get to use it!
Web Deployment Projects to fix Lack of Web Project Files
http://weblogs.asp.net/pwilson/archive/2005/10/05/426689.aspx
I just saw a demo of a new feature that the MS ASP.NET team will be releasing as an add-on to VS 2005 -- it should be available at launch too. Its called Web Deployment Projects and its basically allowing you to handle a lot of the scenarios we used to be able to do with web project files -- and more. Under the cover its just a standard MSBuild file, so its already well documented and very extensible, but its also going to hook in the new aspnet_merge tool and provide a basic UI for common scenarios. Things you'll be able to do include specifying whether or not you want one assembly per page, folder, or entire web project -- and you'll be able to specify several naming options for those assemblies too. You'll also be able to have different build configuration options like you can today in VS 2003 -- but even better than today you'll be able to have the build process link or replace parts of your web.config file with configuration specific web.config pieces (like separate connection strings for debug, staging, and release). You'll also be able to specify things like assembly signing and you'll be able to tell it the asp.net compiler to follow the IIS metabase paths so that sub-webs are effectively excluded. It looks like its very much on track to give us everything we were missing from VS 2003, and more, as well as giving as an extensible solution for anything else we can dream up since this is just an MSBuild file like all the other project files. And of course this will be completely optional, so all those that have liked the simplicity of not having a web project file will in no way be forced to use this new web deployment project. Very cool stuff -- and I'm very glad that MS had listened to those of us that had issues with the lack of the web project.
Visual Studio 2005 Web Deployment Projects
http://aspadvice.com/blogs/ssmith/archive/2005/10/05/Visual_Studio_2005_Web_Deployment_Projects.aspx
The ASPInsiders were just introduced to an upcoming and as-yet-unannounced addin for Visual Studio 2005 that should ship with or close to RTM. The feature is called Web Deployment Projects, and will extend VS 2005's capabilities for building and deploying ASP.NET web projects. VS 2005 did away with web project files, and there has been some pushback in the community on this because there are many enterprise scenarios where project files make sense (they were removed because they cause a lot of pain in VS 2002/2003).
The Web Deployment Projects feature works like this. It's an addin, so it builds on top of VS 2005 but doesn't touch any of the actual bits there (it's separate). So, it's optional if you want to install it, but most enterprise users will likely want to do so. To create one, right click on a website in VS2005 solution explorer and select the new menu item, Add Web Deployment Project. This will add a new project to the solution which will manage the build and deploy options for the website.
The Web Deployment Project is literally just an MSBuild file, with some UI to help set it up. You can always drop down and hand edit the MSBuild file if you need to. The UI covers most of the usual scenarios, though, and supports separate configurations for deployment for each different build config in Visual Studio. Some scenarios it enables out of the box are:
Precompiling websites
Merging precompiled outputs into single assembly
Swapping out config sections per-configuration option
Swapping out entire config files per configuration option
Include/Exclude different folders/files per configuration option
At RTM there will be 2 white papers published detailing how this was built and how to use it in a variety of scenarios. This is not RTM so you should expect to see some other blogs talking about it today and in the near future. There were a lot of things that VS2005 couldn't easily do because of its omission of web project files, so this is a great addition that covers most (all?) of these scenarios.
http://blogs.msdn.com/anutthara/archive/2005/10/20/483091.aspx
That's almost true .... :) Last week I was involved with testing an add in that the ASP.NET team was working on - it is called "Web deployment projects". This is an add in that will be shipped about the same time as VS 2005. Having used VS 2003 back in school, when I joined MSFT after graduating, I was a little unsettled at the thought of having web "projects" without project files! In the course of 2 years, I became used to this model though the pain of not having a project file would surface now and then.
With this add in, you can now associate any web app with a web deployment project that is nothing but an MSBuild project file. It is as easy as a right click + add. The web deployment project can be configured to built in various configurations and can automatically deploy your website on an IIS server (pretty cool from a Team Build perspective too). This comes integrated with the Asp_merge tool that can actually compile your web project into a single dll with a sane name (compare against the App32435435__90blah blah.dll that is auto generated now) or separate dlls per folder or per page. You can also replace sections of your web.config file in a simple UI to override specific settings. Strong name signing is also built into this UI along with options for delay signing. Of course, since this is an MSBuild project file, it is highly extensible and stubs are already provided in the project file to override and add custom tasks.
Undoubtedly, the feature I liked best was the IIS deployment feature, where you can choose the virtual directory to deploy to and also opt to delete pre-existing directories or not. The coolth of it is the integration it brings to Team Build web testing scenarios. Users that run web tests on web apps built in Team Build need to deploy the app on the IIS server on the build machine. There was no out of the box solution for this and it involved having to write custom tasks in order to deploy the web app. Now, all we need to do is include the deployment project in the team project to build, and lo - the web tests can run with no custom tasks in between.
I was pretty charmed by this add in, so much that I wondered why this wasn't part of the product itself ;-)
Let me know what you think of the web deployment project add in when you get to use it!
Web Deployment Projects to fix Lack of Web Project Files
http://weblogs.asp.net/pwilson/archive/2005/10/05/426689.aspx
I just saw a demo of a new feature that the MS ASP.NET team will be releasing as an add-on to VS 2005 -- it should be available at launch too. Its called Web Deployment Projects and its basically allowing you to handle a lot of the scenarios we used to be able to do with web project files -- and more. Under the cover its just a standard MSBuild file, so its already well documented and very extensible, but its also going to hook in the new aspnet_merge tool and provide a basic UI for common scenarios. Things you'll be able to do include specifying whether or not you want one assembly per page, folder, or entire web project -- and you'll be able to specify several naming options for those assemblies too. You'll also be able to have different build configuration options like you can today in VS 2003 -- but even better than today you'll be able to have the build process link or replace parts of your web.config file with configuration specific web.config pieces (like separate connection strings for debug, staging, and release). You'll also be able to specify things like assembly signing and you'll be able to tell it the asp.net compiler to follow the IIS metabase paths so that sub-webs are effectively excluded. It looks like its very much on track to give us everything we were missing from VS 2003, and more, as well as giving as an extensible solution for anything else we can dream up since this is just an MSBuild file like all the other project files. And of course this will be completely optional, so all those that have liked the simplicity of not having a web project file will in no way be forced to use this new web deployment project. Very cool stuff -- and I'm very glad that MS had listened to those of us that had issues with the lack of the web project.
Visual Studio 2005 Web Deployment Projects
http://aspadvice.com/blogs/ssmith/archive/2005/10/05/Visual_Studio_2005_Web_Deployment_Projects.aspx
The ASPInsiders were just introduced to an upcoming and as-yet-unannounced addin for Visual Studio 2005 that should ship with or close to RTM. The feature is called Web Deployment Projects, and will extend VS 2005's capabilities for building and deploying ASP.NET web projects. VS 2005 did away with web project files, and there has been some pushback in the community on this because there are many enterprise scenarios where project files make sense (they were removed because they cause a lot of pain in VS 2002/2003).
The Web Deployment Projects feature works like this. It's an addin, so it builds on top of VS 2005 but doesn't touch any of the actual bits there (it's separate). So, it's optional if you want to install it, but most enterprise users will likely want to do so. To create one, right click on a website in VS2005 solution explorer and select the new menu item, Add Web Deployment Project. This will add a new project to the solution which will manage the build and deploy options for the website.
The Web Deployment Project is literally just an MSBuild file, with some UI to help set it up. You can always drop down and hand edit the MSBuild file if you need to. The UI covers most of the usual scenarios, though, and supports separate configurations for deployment for each different build config in Visual Studio. Some scenarios it enables out of the box are:
Precompiling websites
Merging precompiled outputs into single assembly
Swapping out config sections per-configuration option
Swapping out entire config files per configuration option
Include/Exclude different folders/files per configuration option
At RTM there will be 2 white papers published detailing how this was built and how to use it in a variety of scenarios. This is not RTM so you should expect to see some other blogs talking about it today and in the near future. There were a lot of things that VS2005 couldn't easily do because of its omission of web project files, so this is a great addition that covers most (all?) of these scenarios.
Sunday, October 30, 2005
Looking for resources to learn about ClickOnce?
Saurabh has compiled a list of resources for ClickOnce at his blog:
Top X ways to learn about ClickOnce -
ClickOnce Discussion Forums:
External forum - http://forums.microsoft.com/msdn/ShowForum.aspx?ForumID=6 - As I as have mentioned earlier in my blogs, the forum is the ideal site to go to with ClickOnce issues, bugs, feature request and even general discussion on App Model/Deployment. It is looked at regularly by the ClickOnce product team who do a great of following up on the posts.
Microsoft sites:
Smart Client Dev Center Home: http://msdn.microsoft.com/smartclient/understanding/windowsforms/2.0/features/clickonce.aspx
MSDN content on ClickOnce - http://msdn2.microsoft.com/en-us/library/wh45kb66(en-us,vs.80).aspx.
Video of Jamie Cool the PM on the Winforms/ClickOnce team demoing ClickOnce - http://channel9.msdn.com/ShowPost.aspx?PostID=15303
Article by Brian Noyes on configuring trust with ClickOnce - http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwinforms/html/clickoncetrustpub.asp
Article on ClickOnce and Regfree COM - http://msdn.microsoft.com/msdnmag/issues/05/04/RegFreeCOM/default.aspx
Overview article by Brian Noyes - http://msdn.microsoft.com/msdnmag/issues/04/05/ClickOnce/ - Bit old so some specifics may have changed but overall is accurate)
Non-Microsoft sites:
Links to various ClickOnce related material - http://www.installsite.org/pages/en/clickonce.htm.
VS Support for ClickOnce - http://www.ondotnet.com/pub/a/dotnet/2004/10/11/clickonce.html
Another VS walkthrough - http://www.15seconds.com/issue/041229.htm
Few Blog references to ClickOnce:
Saurabh's blog - http://blogs.msdn.com/saurabh/ -
The one stop Authoratative ClickOnce Resource (well Sammer's mail didn't say so but it should have :-) )
http://mtaulty.com/blog/(5re21u3e1v3wjmm1qhgybqfo)/archive/2004/07/05/524.aspx http://mtaulty.com/blog/(32qtav45kx5a5zeb2taste3j)/archive/2004/07/06/525.aspx
Top X ways to learn about ClickOnce -
ClickOnce Discussion Forums:
External forum - http://forums.microsoft.com/msdn/ShowForum.aspx?ForumID=6 - As I as have mentioned earlier in my blogs, the forum is the ideal site to go to with ClickOnce issues, bugs, feature request and even general discussion on App Model/Deployment. It is looked at regularly by the ClickOnce product team who do a great of following up on the posts.
Microsoft sites:
Smart Client Dev Center Home: http://msdn.microsoft.com/smartclient/understanding/windowsforms/2.0/features/clickonce.aspx
MSDN content on ClickOnce - http://msdn2.microsoft.com/en-us/library/wh45kb66(en-us,vs.80).aspx.
Video of Jamie Cool the PM on the Winforms/ClickOnce team demoing ClickOnce - http://channel9.msdn.com/ShowPost.aspx?PostID=15303
Article by Brian Noyes on configuring trust with ClickOnce - http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwinforms/html/clickoncetrustpub.asp
Article on ClickOnce and Regfree COM - http://msdn.microsoft.com/msdnmag/issues/05/04/RegFreeCOM/default.aspx
Overview article by Brian Noyes - http://msdn.microsoft.com/msdnmag/issues/04/05/ClickOnce/ - Bit old so some specifics may have changed but overall is accurate)
Non-Microsoft sites:
Links to various ClickOnce related material - http://www.installsite.org/pages/en/clickonce.htm.
VS Support for ClickOnce - http://www.ondotnet.com/pub/a/dotnet/2004/10/11/clickonce.html
Another VS walkthrough - http://www.15seconds.com/issue/041229.htm
Few Blog references to ClickOnce:
Saurabh's blog - http://blogs.msdn.com/saurabh/ -
The one stop Authoratative ClickOnce Resource (well Sammer's mail didn't say so but it should have :-) )
http://mtaulty.com/blog/(5re21u3e1v3wjmm1qhgybqfo)/archive/2004/07/05/524.aspx http://mtaulty.com/blog/(32qtav45kx5a5zeb2taste3j)/archive/2004/07/06/525.aspx
Saturday, October 08, 2005
First Experience while working with Visual Studio Team Foundation Server (Beta 3)
I just finished installing the Team Foundation Client on my machine. I also installed the Team Foundation Proxy on a server hosted here locally in Hyderabad. (My TFS Server is out in Redmond).
My VS2005 IDE was configured to use VSS.
I had to switch the Source-Control Options to "Visual Studio Team Foundation Server".
My VS2005 IDE was configured to use VSS.
I had to switch the Source-Control Options to "Visual Studio Team Foundation Server".
I also had to set the location of the Proxy server that I had configured.
I checked in an entire project into the source control and it took less than 2 minutes. The same thing if I had used VSS, it might have taken me at least 2-3 hours due to the distance between Hyderabad (India) and Redmond (USA)).
Incredible speed!!!
VSTS ROCKS!!!!!
Friday, October 07, 2005
patterns & practices Security Guidance for Applications Index
The Patterns and Practices team has published an index of patterns & practices Security Guidance for applications. The resources include guides and books available on MSDN together with modular content of various types including scenarios and solutions, guidelines, explained, checklists, and How Tos.
This article is also available via an easy to remember url: http://www.msdn.com/SecurityGuidance
The index to the .NET 2.0 security guidance can be found at: http://msdn.microsoft.com/library/en-us/dnpag2/html/AppSecGuidanceForFrameworkV2.asp.
So now you know where to go for any Security Related guidance.
Enjoy!
This article is also available via an easy to remember url: http://www.msdn.com/SecurityGuidance
The index to the .NET 2.0 security guidance can be found at: http://msdn.microsoft.com/library/en-us/dnpag2/html/AppSecGuidanceForFrameworkV2.asp.
So now you know where to go for any Security Related guidance.
Enjoy!
Tuesday, September 20, 2005
Security Guidance for .NET Framework 2.0
I read about a nice blog regarding Security in .NET Framework 2.0 .
The patterns and practices folks have been getting rave reviews for the Security Guidance for the .NET Framework 2.0 content they've assembled. There are 25 "how-to's" currently available with a bunch more coming soon.
The available ones are:
How To: Configure the Machine Key in ASP.NET 2.0
How To: Connect to SQL Server Using SQL Authentication in ASP.NET 2.0
How To: Connect to SQL Server Using Windows Authentication in ASP.NET 2.0
How To: Create a Service Account for an ASP.NET 2.0 Application
How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI
How To: Encrypt Configuration Sections in ASP.NET 2.0 Using RSA
How To: Instrument ASP.NET 2.0 Applications for Security
How To: Prevent Cross-Site Scripting in ASP.NET
How To: Protect Forms Authentication in ASP.NET 2.0
How To: Protect From Injection Attacks in ASP.NET
How To: Protect From SQL Injection in ASP.NET
How To: Use ADAM for Roles in ASP.NET 2.0
How To: Use Authorization Manager (AzMan) with ASP.NET 2.0
How To: Use Code Access Security in ASP.NET 2.0
How To: Use Forms Authentication with Active Directory in ASP.NET 2.0
How To: Use Forms Authentication with Active Directory in Multiple Domains in ASP.NET 2.0
How To: Use Forms Authentication with SQL Server in ASP.NET 2.0
How To: Use Health Monitoring in ASP.NET 2.0
How To: Use Impersonation and Delegation in ASP.NET 2.0
How To: Use Medium Trust in ASP.NET 2.0
How To: Use Membership in ASP.NET 2.0
How To: Use the Network Service Account to Access Resources in ASP.NET
How To: Use Regular Expressions to Constrain Input in ASP.NET
How To: Use Role Manager in ASP.NET 2.0
How To: Use Windows Authentication in ASP.NET 2.0
