book

Programming Microsoft® ASP.NET MVC

Name: Programming Microsoft® ASP.NET MVC
Author: Dino Esposito
ISBN: 9780735665644

by Dino Esposito

October 2011

Intermediate to advanced

464 pages

13h 20m

English

Microsoft Press

Read now

Unlock full access

Dedication
A Note Regarding Supplemental Files
Introduction
Who Should Read This BookAssumptionsWho Should Not Read This BookSystem RequirementsCode SamplesErrata & Book SupportWe Want to Hear from YouStay in Touch
Acknowledgments
I. ASP.NET MVC Fundamentals
1. ASP.NET MVC Controllers
Routing Incoming RequestsSimulating the ASP.NET MVC RuntimeDefining the Syntax of Recognized URLsDefining the Behavior of the HTTP HandlerInvoking the HTTP HandlerThe URL Routing HTTP ModuleSuperseding URL RewritingRouting the RequestsInternal Structure of the URL Routing ModuleApplication RoutesURL Patterns and RoutesDefining Application RoutesProcessing RoutesRoute HandlerHandling Requests for Physical FilesPreventing Routing for Defined URLsThe Controller ClassAspects of a ControllerGranularity of ControllersStateless ComponentsFurther Layering Is Up to YouHighly TestableWriting Controller ClassesFrom Routing to ControllersFrom Routing to ActionsActions and HTTP VerbsAction MethodsProcessing Input DataGetting Input Data from the Request ObjectGetting Input Data from the RouteGetting Input Data from Multiple SourcesThe ValueProvider DictionaryProducing Action ResultsInside the ActionResult ClassPredefined Action Result TypesMechanics of Executing Action ResultsReturning HTML MarkupReturning JSON ContentSpecial Capabilities of ControllersGrouping ControllersThe Rationale Behind AreasDefining Areas in Your ProjectAdding Area Information to RoutesLinking to AreasAsynchronous ControllersMechanics of Asynchronous ActionsThe Async PointAsync Actions in ASP.NET MVCDesigning Asynchronous Action MethodsCoding Asynchronous Action MethodsAttributes of Asynchronous Action MethodsCandidates for Asynchronous ActionsSummary
2. ASP.NET MVC Views
Structure and Behavior of a View EngineMechanics of a View EngineDetecting Registered View EnginesAnatomy of a View EngineWho Calls the View Engine?The View ObjectDefinition of the View TemplateResolving the TemplateDefault Conventions and FoldersThe Template for the ViewThe Master ViewHTML HelpersBasic HelpersRendering HTML FormsRendering Input ElementsAction LinksPartial ViewsThe HtmlHelper ClassTemplated HelpersFlavors of a Templated HelperThe Display HelpersThe Editor HelpersCustom HelpersStructure of an HTML HelperMvcHtmlString Is Better Than Just a StringA Sample HTML HelperA Sample Ajax HelperThe Web Forms View EngineInside the View EngineSearch LocationsSearch Location FormatsVirtual Path ProvidersDesigning a Sample ViewDefining a Master ViewCode BlocksHTML HelpersServer ControlsView and ASP.NET IntrinsicsThe Razor View EngineInside the View EngineSearch LocationsCode NuggetsSpecial Expressions of Code NuggetsThe Razor Syntax and Visual BasicThe Razor View ObjectDeriving from a Custom Base ClassDesigning a Sample ViewDefining the Model for the ViewDefining a Master ViewDefining SectionsDefault Content for SectionsNested LayoutsDeclarative HTML HelpersLimitations of Declarative HTML HelpersTemplated DelegatesTemplated Delegates and Formatted TextTemplated Delegates and Optional SectionsThe ViewStart Page ClassCoding the ViewModeling the ViewThe ViewData DictionaryThe ViewBag DictionaryStrongly Typed View ModelsUsing Expando Objects to Control Class ProliferationPackaging the View-Model ClassesAdvanced FeaturesCustom View EnginesRender ActionsChild ActionsTesting the ViewSummary
3. The Model-Binding Architecture
The Input ModelEvolving from the Web Forms Input ProcessingRole of Server ControlsRole of the View StateInput Processing in ASP.NET MVCRole of Model BindersFlavors of a ModelModel BindingModel-Binding InfrastructureAnalyzing the Method’s SignatureGetting the Binder for the TypeThe Default Model BinderBinding Primitive TypesDealing with Optional ValuesValue Providers and PrecedenceBinding Complex TypesBinding CollectionsBinding Collections of Complex TypesBinding Content from Uploaded FilesCustomizable Aspects of the Default BinderThe Bind AttributeCreating Whitelists of PropertiesCreating Blacklists of PropertiesUsing a PrefixAdvanced Model BindingCustom Type BindersCustomizing the Default BinderImplementing a Model Binder from ScratchRegistering a Custom BinderA Sample DateTime Model BinderThe Displayed DataThe Controller MethodCreating the DateTime BinderSummary
4. Input Forms
General Patterns of Data EntryA Classic Select-Edit-Post ScenarioPresenting Data and Handling the SelectionEditing DataSaving DataApplying the Post-Redirect-Get PatternKeeping the URL and Content in SyncSplitting POST and GET ActionsUpdating Only via POSTSaving Temporary Data Across RedirectsAjax-Based FormsCreating an Ajax FormInfrastructure for Ajax-Based FormsAjax-Aware Controller MethodsUpdating the Page Title After an Ajax RequestUnobtrusive JavaScript CodeTroubles with Unobtrusive AjaxAjax HyperlinksAutomating the Writing of Input FormsPredefined Display and Editor TemplatesAnnotating Data Members for DisplayDefault Templates for Data TypesCustom Templates for Data TypesData Type ValidationRead-Only MembersCustom Templates in RazorCustom Templates for Model Data TypesTabular TemplatesDealing with Nested ModelsInput ValidationUsing Data AnnotationsValidation Provider InfrastructureDecorating a Model ClassDealing with Enumerated TypesControlling Error MessagesAdvanced Data AnnotationsCross-Property ValidationCreating Custom Validation AttributesEnabling Client-Side ValidationCulture-Based, Client-Side ValidationValidating Properties RemotelySelf-ValidationThe IValidatableObject InterfaceBenefits of Centralized ValidationThe IClientValidatable InterfaceDynamic Server-Side ValidationSummary
II. ASP.NET MVC Software Design

5. Aspects of ASP.NET MVC Applications
ASP.NET Intrinsic ObjectsSEO and HTTP ResponsePermanent RedirectionDevising Routes and URLsThe Trailing SlashManaging the Session StateUsing the Session ObjectNever Outside the ControllerCaching DataThe Bright Side and Dark Side of the Native Cache ObjectInjecting a Caching ServiceA Better Way of Injecting a Caching ServiceDistributed CachingCaching the Method ResponsePartial Output CachingError HandlingHandling Program ExceptionsHandling Exceptions DirectlyOverriding the OnException MethodUsing the HandleError AttributeGlobal Error HandlingGlobal Error Handling from global.asaxGlobal Error Handling Using an HTTP ModuleIntercepting Model-Binding ExceptionsHandling Route ExceptionsDealing with Missing ContentCatch-All RouteSkipping IIS Error-Handling PoliciesLocalizationUsing Localizable ResourcesNo Global, No Local—Just ResourcesLocalizable TextLocalizable FilesReferencing Embedded FilesLocalizable ViewsDealing with Localizable ApplicationsAuto-Adapting ApplicationsMultilingual ApplicationsChanging Culture ProgrammaticallyStoring Localized Resources in a DatabaseSummary
6. Securing Your Application
Security in ASP.NET MVCAuthentication and AuthorizationConfiguring Authentication in ASP.NET MVCRestricting Access to Action MethodsHandling Authorization for Action MethodsAuthorization and Output CachingExtending the Authorize AttributeNot Logged In or Not Authorized?Hiding Critical User Interface ElementsImplementing a Membership SystemDefining a Membership ControllerValidating User CredentialsIntegrating with the Membership APIIntegrating with the Role APIThe Remember-Me Feature and AjaxReproducing the ProblemSolving the ProblemExternal Authentication ServicesThe OpenID ProtocolIdentifying Users Through an OpenID ProviderOpenID vs. OAuthAuthenticating via TwitterRegistering Your ApplicationStarting the Authentication ProcessDealing with the Twitter ResponseThe Token ManagerSummary
7. Design Considerations for ASP.NET MVC Controllers
Shaping Up Your ControllerChoosing the Right StereotypeRDD at a GlanceBreaking Down the Execution of a RequestActing as a “Controller”Acting as a “Coordinator”Fat-Free ControllersShort Is Always BetterAction Methods Coded as View Model BuildersWorker ServicesImplementing a Worker ServiceDo We Really Need Controllers?The Ideal Action Method CodeConnecting the Presentation and Back EndThe iPODD PatternBeyond Classic LayersThe (Idiomatic) Presentation LayerThe Orchestration LayerThe Domain LayerExposing Entities of the DomainThe Data LayerInjecting Data and Services in LayersThe Dependency Inversion PrincipleThe Service Locator PatternThe Dependency Injection PatternUsing Tools for Inversion-of-ControlPoor Man’s Dependency InjectionGaining Control of the Controller FactoryRegistering a Custom Controller FactoryBuilding a Customer Controller FactoryA Unity-Based Controller FactorySummary
8. Customizing ASP.NET MVC Controllers
The Extensibility Model of ASP.NET MVCThe Provider-Based ModelGallery of Extensibility PointsRealistic Scenarios: Culture-Driven View EngineRealistic Scenarios: Alternate TempData StorageUsing Custom Components in Your ApplicationsThe Service Locator ModelService Locator vs. Dependency InjectionService Locator in ASP.NET MVCDefining Your Dependency ResolverAdding Aspects to ControllersAction FiltersEmbedded and External FiltersClassification of Action FiltersBuilt-in Action FiltersGlobal FiltersGallery of Action FiltersAdding a Response HeaderCompressing the ResponseView SelectorFilling Up the View ModelSpecial FiltersAction Name SelectorsAction Method SelectorsRestricting a Method to Ajax Calls OnlyRestricting a Method to a Given Submit ButtonBuilding a Dynamic Loader FilterInterception Points for FiltersAdding an Action Filter Using Fluent CodeCustomizing the Action InvokerRegistering the Custom InvokerEnabling Dynamic Loading via a Filter ProviderAction Result TypesBuilt-in Action Result TypesReturning a Custom Status CodeReturning JavaScript CodeReturning JSON DataCustom Result TypesReturning JSONP StringsReturning Syndication FeedDealing with Binary ContentReturning PDF FilesSummary
9. Testing and Testability in ASP.NET MVC
Testability and DesignDesign for TestabilityThe Attribute of ControlThe Attribute of VisibilityThe Attribute of SimplicityLoosen Up Your DesignInterface-Based ProgrammingRelativity of Software TestabilityTestability and CouplingTestability and Object OrientationBasics of Unit TestingWorking with a Test HarnessChoosing a Test EnvironmentTest FixturesArrange, Act, AssertData-Driven TestsAspects of TestingVery Limited ScopeTesting in IsolationFakes and MocksNumber of Assertions per TestTesting Inner MembersCode CoverageTesting Your ASP.NET MVC CodeWhich Part of Your Code Should You Test?How Do I Find Relevant Code to Test?The Domain LayerThe Orchestration LayerThe Data Access LayerUnit Testing ASP.NET MVC CodeTesting If the Returned View Is CorrectTesting LocalizationTesting RedirectionsTesting RoutesDealing with DependenciesAbout Mock and Fake ObjectsTesting Code that Performs Data AccessTesting Asynchronous MethodsRefactoring to the Humble Object PatternMocking the HTTP ContextMocking the HttpContext ObjectMocking the Request ObjectMocking the Response ObjectMocking the Session ObjectMocking the Cache ObjectTesting Controller Methods with FiltersSummary
III. Client-Side
10. More Effective JavaScript
Revisiting the JavaScript LanguageLanguage BasicsType SystemNull vs. UndefinedLocal and Global VariablesVariables and HoistingObjectsFunctionsObject-Orientation in JavaScriptMaking Objects Look Like ClassesUsing ClosuresUsing PrototypesPlain Custom Objects vs. a Hierarchy of ClassesjQuery’s Executive SummaryDOM Queries and Wrapped SetsThe Root ObjectRunning a QueryEnumerating the Content of a Wrapped SetSelectorsBasic SelectorsCompound SelectorsPredefined FiltersFilter vs. FindChaining Operations on a Wrapped SetEventsBinding and UnbindingLive Event BindingPage and DOM ReadinessAspects of JavaScript ProgrammingUnobtrusive CodeStyle the View with CodePragmatic Rules of Unobtrusive JavaScriptUsing jQuery Plug-ins to Increase UnobtrusivenessReusable Packages and DependenciesThe Namespace PatternThe Module PatternScript and Resource LoadingThe Download Is Always SynchronousScripts at the BottomNonblocking Scripts DownloadDealing with Static FilesUsing SpritesASP.NET MVC, Ajax and JavaScriptThe Ajax Service LayerA Tailor-Made HTTP FaçadeASP.NET MVC Controllers vs. Web ServicesAvoid Exposing WCF Services to Ajax ClientsWays to Write Ajax ASP.NET MVC ApplicationsUsing Ajax HelpersIntricacies of Ajax HelpersUsing JSON Data ProvidersOrganizing JavaScript Code (and Reorganizing Views)A Look at JavaScript UpdatersIntricacies of JSON-Based SolutionsSummary
A. About the Author
Index
About the Author
Copyright

Content preview from Programming Microsoft® ASP.NET MVC

Chapter 6. Securing Your Application

Security is a kind of death.
—Tennessee Williams

Security means a variety of things to users and developers. In a web context, security is related to preventing injection of malicious code in the running application. Likewise, security relates to actions aimed at preventing disclosure of private data. Finally, security relates to building applications (and sections of an application) that only authenticated and authorized users can access.

The aspect of security that application developers deal with more frequently is certainly the authentication and authorization of users. In fact, although they are based on a number of common patterns, the first two aspects of web security need to be tackled while keeping an ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9780735665644Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Programming Microsoft® ASP.NET MVC

by Dino Esposito

Chapter 6. Securing Your Application

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.