“Best Developer” Award by TRG; The Resource Group

I have been recently awarded the “Best Developer” accolade by my company, TRG; The Resource Group at the Annual Employee Appreciation Day 2007 on 3rd Feburary 2008.

It was a total surprise for me and unfortunately I missed the ceremony (was out of town) :( but still it’s always a good feeling, to be the one amongst the hundreds :)

The much awaited .NET Framework source code is finally available

The source code of .NET Framework is finally available under a read only reference license, enabling programmers to browse the source code and debug their programs more deeply and effectively.

It seems that now the code of .NET Framework is so mature that they are releasing it for public. Let’s see how the proponents of open source perceive it.

Currently the following libraries have their source code available for browsing and debugging.

• NET Base Class Libraries (including System, System.CodeDom, System.Collections, System.ComponentModel, System.Diagnostics, System.Drawing, System.Globalization, System.IO, System.Net, System.Reflection, System.Runtime, System.Security, System.Text, System.Threading, etc).
• ASP.NET (System.Web, System.Web.Extensions)
• Windows Forms (System.Windows.Forms)
• Windows Presentation Foundation (System.Windows)
• ADO.NET and XML (System.Data and System.Xml)

More and more libraries are said to be included in the above list.

You can refer to the the post by Shawn Burke on how to configure your Visual Studio 2008 to debug the .NET Framework Source Code.

FireBug + YSlow for Mozilla Firefox: A must use tool for all Web2.0 developers

I have been very keen in improving the response time of web applications and used to postmortem the web applications from the perspective of their initial load time, overall network traffic created, number of requests sent and the overall network traffic created to perform an action and a number of other parameters.

In order to perform this postmortem, the Mozilla add on in the name of Firebug comes in picture and really provide very useful and good enough information on the overall network traffic created, contents of each of the user request / server response, runtime inspection and modification in the CSS, HTML and Javascript of the currently viewed web page, JavaScript Debugger support for the java script statement “debugger;”, DOM Inspector and much more.

Thus, using this tool (Firebug; Mozilla Firefox Add-on), a Web 2.0 developer can very easily analyze which user action creates how much traffic behind the scenes using AJAX, which user action is performed at the client side, how much requests are generated for each user action, what’s the size of request / response for a user action and other such stuff related with the debugging of Java Script, modification in CSS and DOM Inspection. So, I would recommend every web developer who is involved in evaluating the different UI controls to be used in web applications or other such tasks related to improving the overall user experience of a web application to try this add-on; FireBug on FireFox. A snapshot of this tool, is shown below.

There is in add-on in FireBug in the name of YSlow. That provides information on how to improve the performance of your website. This add-on is by Yahoo Developer Network and automates the verification of all the Consideration for High Performance Websites in this single tool. This not only verifies and ranks the website against the said Best Practices for High Performance websites, but also provides information on what’s wrong and what you can do to improve the performance. A snap shot of the YSlow Addon of Firebug is shown below.

Something similar but with relatively lesser features is the IE Developer Toolbar, which Internet Explorer centric Web 2.0 developers, should definitely have a look at and experiment with. [Added: 22nd April 2008]

Another easy to use tool out there for Internet Explorer to perform a similar analysis of web applications (a bit buggy on I.E 6 at least on my machine) is the Web Development Helper by Nikhil Khotari. Below is the snapshot of that.

ASP.NET 3.5 Extensions Preview: Dynamic Data Websites Part 1, Engineering Data Centric Web Application from End-to-End

I hope you have gone through my last post that lists all pre-requisites for this tutorial and have prepared the development environment, on how to get hands on with these tutorials and walkthroughs on the newly added features in ASP.NET 3.5 Extensions Preview.

Here comes the very first tutorial in the series that’s on the Dynamic Data Websites. The reason for starting the ASP.NET 3.5 Extensions Preview tutorial series with this Dynamic Data Websites feature is to demonstrate how quickly you can engineer a data centric web application with the newly added features of ASP.NET 3.5 Extensions Preview. You will learn that the overall code required to be written by the end developer is reduced to the extent that one merely needs to write a few lines for any custom business rules or any customized view of the data which one may require as per the custom needs.

The pre-requisite, the portion I will not be covering in this tutorial for engineering a data centric web application from end-to-end is the designing of the database. I will assume that you have your database designed, tables and relationships with Primary and Foreign Keys created. The database I will be using for my tutorials as stated in the last post is the well known, Microsoft provided “Northwind” database.

So let’s start with the step by step walkthrough, in this part of Dynamic Data Website walkthrough I will be covering on how to engineer a web application with the built-in templates and features as provided by Microsoft in the ASP.NET 3.5 Extensions Preview. In the next post I will demonstrate on how to customize the generated web application by incorporating custom business rules and designing custom views as per the custom needs of your business. So, let’s get started with the step by step procedure.

1. Create a new website, by clicking the “New Web Site” item in the “File” Menu. A dialog box titled “New Web Site” appears. Select the “Dynamic Data Website” from that “New Web Site” dialog box and set the location for that new Dynamic Data Website. Here I name the website “DDWDemo” i.e. Dynamic Data Website Demo.
   
   


2. A new website containing the files/structure as shown below is created.
   
   


3. Now we need to add database to our web application, for that I create the App_Data folder in my web application and drag n drop the mdf file of the “Northwind” database to it.
   
   


4. Now we have our database added to our web application. I will start with generating the Business Entities for my Northwind database, so that I map my data in the Relational World to my Object Oriented World, and doing so is facilitated by the “LINQ to SQL Classes” feature of the ASP.NET 3.5 Extensions Preview. I will create a new LINQ to SQL Classes instance, which are internally mapped to relational objects, by right clicking on my website and selecting Add New Item. I select the LINQ to SQL Classes template and name it SCM.dbml (here SCM stands for Supply Chain Management and not the Software Configuration Management) and click Add. A prompt appears asking me to automatically put the files in the App_Code folder; I click on ‘Yes’ for it, and my LINQ to SQL Classes files is added in my project. This file provides me an Object Relational Designer through which I can easily generate my DataContext Class as well as the ADO.NET Entity Classes.
   
   
   


5. Now what we do is that I double click on my Northwind database in the App_Data folder, it will open the database in the Database Explorer. I expand all the tables under it, select all the tables and drag and drop them on the left pane of the SCM.dbml file, that’s the object relational designer surface to auto generate my Data Classes for all the tables I have dropped on it. It will also automatically create the relationships among the generated classes by improvising them form Primary / Foreign Key Relationships in the Database. You can view the code generated by this action by expanding the SCM.dbml file and browsing the SCM.designer.cs file. The SCM.designer.cs file will contain the definition of SCMDataContext that allows access to all tables and handles the CRUD operations on the Business Entities through LINQ queries, moreover the SCM.designer.cs file contains definition of all the business entities, which are actually the ADO.NET Entities. One thing to note about them is that these generated business entities are defined as partial classes and also provides some extensibility methods (we will learn using them in part 2 of this tutorial).
   
   
6. So, by now we have our Business Entities defined which are directly mapped to the Tables. Now we need to present them in a good way to the user so that User can perform the CRUD (Create, Read, Update and Delete) operations on these. This is facilitated by the use of templates defined in the Dynamic Data Website template. What we need to do is to set the enableTemplates attribute of the dynamicData section in web.config file to true. I can also optionally set the dataContextType attribute of dynamicData to SCMDataContext. So here, what I have done is that I have enabled the templates for the List and Details view of all the Business Entities defined in the SCMDataContext. By default it will use the ListDetailsTemplate.aspx for all the business entities. The ListDetailsTemplates.aspx is defined in the subfolder App_Shared/DynamicDataPages so that I can customize it to give a personalized look and feel. This template uses the master page defined in the website as MasterPage.master which I can customize too for the personalized look and feel; here I customize the main heading of the website to be ‘Supply Chain Management’ instead of dynamic data controls site. Just a food for thought that the ListDetailsTemplates.aspx uses the newly introduced Dynamic Data Controls and I would recommend having a look at these templates to get some idea on how it’s utilizing the features of ASP.NET 3.5 Dynamic Data Controls behind the scenes.
   
   


7. Now, start the web application by clicking on the Start Debugging button in the toolbar of Visual Web Developer 2008. A prompt stating the Debugging isn’t enabled, simply click OK button on it to enable debugging and a web application with the default templates appears in front of you.
   
   

So, here in this tutorial, we have learnt on how to generate a Data Centric Web Application using ASP.NET 3.5 Extensions Preview, in a few clicks. In the second part of this tutorial which I will be posting in a day or two, I will demonstrate on how you can customize the Views for some of the entities, use some other template for some other entities as well as enforcing you custom business rules in the Business Entities.

You can download the complete source code of this walkthrough as a single package from here.

ASP.NET 3.5 Extensions Preview: Walkthroughs, Tutorials and Code Samples

Long time, no posts!!!

With the release of ASP.NET 3.5 Extensions Preview a couple of weeks back, I have been busy in experimenting with the new features and controls added in this very first preview of ASP.NET 3.5 Extensions.

The new additions like Dynamic Data Websites, Dynamic Data Controls, LINQ to SQL, ADO.NET Data Services and their invocation using AJAX, LINQ enhancements, ASP.NET AJAX enhancements definitely added sufficient enough data points to the proponents of ‘Using ASP.NET for RAD’.

Having said all that, the ASP.NET 3.5 Extensions Preview also includes the first public preview
of the much awaited built-in ASP.NET MVC Framework as well, the final release of which is expected in first half of this year. The addition of this built-in ASP.NET MVC Framework added a sound Architectural Pattern to the ASP.NET Web Development portfolio and it not only enforces the separation of concerns but also facilitates TDD that’s the need of the hour.

Earlier this week I have been presenting the said new additions in ASP.NET 3.5 Extensions to my office colleagues in successive training / tutorial sessions titled “What’s new in ASP.NET 3.5” on each of the newly added features and they went great and, from now I will be posting the scripts / walkthroughs with code samples of all those sessions over here by this weekend, for my office colleagues in particular and rest of you in general.

I used the well know “Northwind” database in all the tutorials so that I every one has the general idea of the DB Schema. For your convenience I will be including the Database files in the sample codes of each of the tutorial as well, in order to provide you a single code sample package for each of the tutorial.

In the mean time I would recommend all of you to prepare the Development Environment for those tutorials and walkthroughs accompanying the code samples which I will be posting by this weekend. All you need to have on your system is the Visual Studio 2008 and the newly released ASP.NET 3.5 Extensions Preview. If you don’t have Visual Studio 2008 then for the time being you can go with the free Visual Web Developer 2008 Express Edition as well instead of Visual Studio 2008. You can download Visual Web Developer from here and the ASP.NET 3.5 Extensions Preview from here.

Keep your fingers crossed for Walkthroughs + Code Samples on Dynamic Data Websites, ADO.NET Data Services, LINQ and last but not the least the ASP.NET MVC Framework.

The Technology Bubble

Here is a Silicon Valley music video by the Richter Scales, a must watch for all those web geeks out there, who are inspired by the success of MySpace, Orkut, Facebook, Digg, Flickr, Del.icio.us ..... blah blah. Hope you will enjoy it

http://www.youtube.com/watch?v=I6IQ_FOCE6I
(Links Updated On 29th December 2007)

Engineering Secure Web Apps in ASP.NET 2.0

Security is one of the critical components in the engineering of any web application but unfortunately it isn’t handled in an equally critical way. With an ever increasing popularity of providing access to information over the web at a mouse-click, security concerns are increasing with a similar pace.

Below I have jolted down the list of some of the major security related items (you can call them ASP.NET security best practices, security checklist or the tips and tricks for engineering secure web applications in ASP.NET) which one must keep in mind, while engineering an ASP.NET Web application in which “SECURITY IS A CONCERN”.

My approach is not to provide you the complete end to end solution to each of the concern, but to highlight and provide pointers to the different approaches to cater each of these security items in the check list.

User Authentication

• You can use the built-in authentication mechanisms (Forms, Windows and Passport) or Custom Authentication (Session Based; storing some user specific value in user’s session at the time of authentication so as to validate the user for subsequent requests by the same user, Using Hidden Fields; the traditional way but un secure way of maintaining authenticated user information etc).
• You can use the built-in login controls provided in ASP.NET 2.0. Additionally in order to have a granular control over the User Authentication process refer to the Membership and Role Management API. In case you want the Login Controls / Management API to work with your custom database, you can write your own Membership and Role Provider.
• In case you need to implement the “remember me on this computer” feature, use cookies with “One Time Password” design pattern.

Encrypt sections of the configuration file having confidential information

• Whenever you need to put any confidential information in the configuration file like the database user name / password, don’t leave that information in plain text in the configuration file, rather encrypt it using the built-in “aspnet_regiis” utility with the command line option “-pe”. The aspnet_regiis.exe is located at :\WINDOWS\Microsoft.NET\Framework\v2.0.50727.
• Once a section of the web.config file is encrypted then contents of that section aren’t human readable whenever that file is opened in some text editor, however when you access the configuration information through ASP.NET (the .NET 2.0 framework) it knows how to decrypt the contents and provide actual contents to the application.
• You can use the Management API in order to programmatically encrypt the sections of your Web.Config file. The Management API added in ASP.NET 2.0 is very rich and provides you access to the complete configuration of the application and ability to modify the configuration file on the fly.

One-way encrypt the user passwords before storing in database

• Never store user passwords in the database, in plain text. Store them in Encrypted format using any one way encryption algorithm like MD5, best is to encrypt (MD5) the user passwords at the client side using JavaScript and then at the server store it in the database.
• Later on when the user wants to log in, encrypt the user entered password using the same encryption algorithm and then match it with the password in the database.
• In case the user has forgotten his password, provide user an interface to set a new password after performing necessary validations. You can send a link to set new password for that user at his email address.

Use database user having limited rights

• Create a user in the database that has limited rights (INSERT, UPDATE, SELECT and may be DELETE from specific tables) only those tables of the database that needs to be accessed by your web application, and use that user to access the database from within your application.

Show custom error pages with user friendly error messages

• Never show the built in error page, telling the complete error detail for debugging the error to your end user. That discloses a lot of information that’s not intended for an end user.
• You should better show custom error pages to the user with user friendly error messages while Logging the actual error occurred for the application developers to re-produce / debug and eventually resolve that error.
• Always handle any of the unhandled exception in the Application_OnError event, use the Server.GetLastError() to get the detailed information about the error that occurred, while showing the user a custom error page and logging the actual error.

Check the Request’s Referrer Property

• Check that the request has actually originated from your own website (from an intended page). Not checking so can lead to un precedent attacks

Handle SQL Injection Attacks

• If you are using stored procedures, then you will be using SQL Parameters to send the user input to it and get the results. In that case your application isn’t prone to SQL Injections. However using the Stored Procudures or not in your web application is another debate, lets not get into that and focus on handling SQL Injections.
• The problem comes when you are using inline queries and concatenates the user input with in the SQL Query. A well tailored user input by a hacker can break your security checks as well as can possibly drop the tables in your database etc. by using the single quotes and comment signs with in the user input. So concatenating the user input’s as is in inline SQL Queries can be fatal for your web application.
• Use SQL Parameters even with “inline queries”, they automatically cater for the SQL Injection attacks.

Handle Cross Site Scripting Attacks

• ASP.NET default behavior doesn’t allow the user to enter tags “” and shows an error page if such input is entered in a form field.
• Some application may need to allow the user to enter information in tags, but this will result in potential security leaks, that’ named Cross Site Scripting. A user can write the <script&rt; tag, which can be possibly rendered to another user browsing the site. That script tag will be executed in the context of that second user, and that intelligently tailored script tag can possibly access the second user cookies etc and moreover can possibly submit a malicious request with the second user credentials using XML Http Request / AJAX etc.
• Use the Microsoft’s AntiXSS Library to handle cross site scripting attacks.

Handle Dictionary Attacks – Captcha

• Hackers can attack your website authentication system and submit automated login requests to crack the passwords of authenticated users of your protected website. You should check that your Login form / Authentication system isn’t attacked by this, by ensuring that it’s accessed by humans (asking the user to enter the characters shown on a bit distorted but human readable image). For more information on Dictionary Attacks point to Wikipedia

Denial of Service Attacks

• The last resort for any hacker of your website is the denial of service attacks. You should track the activity for each of the user and should limit the repeated requests sent by the same IP to a decent number.
• You can use the ASP.NET AJAX Control Toolkit – No Robot Control to help you out in this, but it should be used with caution as stated on the above website.

Log user activity

• This way you don’t only capture some very useful data about the user trends but this data can also help you detect any un-desired activity made by the user.
• You can use the Enterprise Library Logging Application Block log the user activity. Microsoft Enterprise Library’s Logging Application Block has the feature to log in the database, so that you can later on query it and create reports on it to find not only any interesting patterns based on “User Pathology” but can also point out any un-desired user activity.

I hope this pretty much covers most of the security check list items. However, I will be adding more and more to it, to provide a to-date comprehensive guide for engineering secure web apps in ASP.NET 2.0