mike's web log

Paging and posting with the Razor WebGrid Helper

Wed, 06 Jun 2012 08:56:19 GMT

The ASP.NET Web Pages/Razor WebGrid helper lets you enable paging just by setting the rowsPerPage property:

var grid = new WebGrid(source: selectedData, rowsPerPage: 3);

Sometimes you want to be able to both to page and to filter the items that are displayed by the WebGrid helper. Here’s an example from the tutorial I posted on the http://asp.net/web-pages site a couple of weeks ago:

The typical (?) approach here is to create a <form> element and set its method attribute to post:

<form method="post">
  <div>
    <label for="searchGenre">Genre to look for:</label>
    <input type="text" name="searchGenre" value="" />
    <input type="Submit" value="Search Genre" /><br/>
    (Leave blank to list all movies.)<br/>
    </div>
</form>

In the page’s code, you create an is(IsPost) block in which you set up a parameterized SQL query and run that:

@{
    var db = Database.Open("WebPagesMovies") ;
    var selectCommand = "SELECT * FROM Movies";
    var searchTerm = "";

    if(IsPost && !Request.QueryString["searchGenre"].IsEmpty() ) { 
        selectCommand = "SELECT * FROM Movies WHERE Genre = @0";
        searchTerm = Request.QueryString["searchGenre"];
    }

    var selectedData = db.Query(selectCommand, searchTerm);
    var grid = new WebGrid(source: selectedData, rowsPerPage:3);
}

[more]

"Remembering" a selection in a <select> list in Razor

Sat, 19 May 2012 21:33:55 GMT

I'm just recording this for now, possibly for later investigation. In ASP.NET Web Pages 2 (Razor), you can take advantage of conditional attributes to set or clear attributes like selected and checked. These attributes don't need a value, they just need to exist, like this:

<select>
  <option value="1">One</option>
  <option value="2" selected >Two</option>
  <option value="3">Three</option>
</select>

So how do you "remember" a list selection after a form submit? Here's one way. This seems a bit kludgy, but I can't offhand think of a way to do this without using JavaScript or something.

< select name="NumberList">
  <option 
   selected=@(Request.Form["NumberList"] == "1")
   value="1">One</option>
  <option 
    selected=@(Request.Form["NumberList"] == "2")                
    value="2">Two</option>
  <option 
    selected=@(Request.Form["NumberList"] == "3")
    value="3">Three</option>                    
</select>

Login redirection (and back) in ASP.NET Web Pages Razor

Tue, 08 May 2012 23:20:34 GMT

When you use membership security in ASP.NET Web Pages Razor, you can limit access to pages so that only logged-in users can see those pages. One way to do that, as explained before, is to add a test like the following to the top of a page (or to the _PageStart.cshtml page in the protected folder):

@{
    if (!WebSecurity.IsAuthenticated) {
        Response.Redirect("~/Login");
    }
}

If the user isn't logged in, they're redirected to the Login page (in this case, in the site's root).

Nice, but then the user still has to find their way back to the page they originally wanted. Ideally, after the user has logged in, you send them back to the original page automatically. And because they're now logged in, the gatekeeper code lets them through.

The usual way to approach this is to include a return URL address when you redirect to the login page. You can add it as a query-string value to the login URL. Then in the login page, once the user has logged in ok, you can get that return URL and jump back.

Here's an updated version of the code from above with some logic to create a return URL:

if (!WebSecurity.IsAuthenticated) {
     Response.Redirect("~/Login?returnUrl=" + Request.Url.LocalPath);
}

For a URL like the following:

http://localhost/members/info.cshtml

The Request.Url.LocalPath property returns this:

/members/info.cshtml

So the URL of the redirect to the Login page looks like this:

http://localhost/Login?returnUrl=/members/info.cshtml

The login page can then return to the original page using logic like this:

if(IsPost){
    var username = Request.Form["username"];
    var password = Request.Form["password"];
 [more]

Razor tip: Escaping the "@" character

Wed, 25 Apr 2012 17:20:43 GMT

In ASP.NET Web Pages/Razor, you use the @ character inside markup to mean "here be code." Like this:

<p>@DateTime.Now</p>

But suppose you want to display the @ character instead of use it to mark code? Like this:

<p>You use the @ character to mark inline code.</p>

Try that in a .cshtml page and you're rewarded with a YSOD:

(Click to embiggen)

Simple fix: escape the @ character with ... another @ character. Like this:

<p>You use the @@ character to mark inline code.</p>

This makes the parser happy.

(h/t, as usual with parser questions: Andrew Nurse)

"Page" vs "PageData" objects in ASP.NET Web Pages

Thu, 19 Apr 2012 01:04:11 GMT

I was playing around with layout pages in ASP.NET Web Pages the other day and realized that there are actually two ways to pass data from the content page to the layout page: the Page object and the PageData object. You can do either of these in the content page:

Page.Title = "My Page";

PageData["Title"] = "My Page";

And then use either of these in the layout page:

<title>@Page.Title</title>

<title>@PageData["Title"]</title>

So what's the difference? Here's what I got from my usual sources.

First, they really are the same object, just with differences in accessors. To show this, you could do the following:

Page.Me = "Mike";

and then get that value doing this:

<p>@PageData["me"]</p>

Notice that the property/value names — Me, "me" — aren't even case sensitive.

Page is a dynamic object, meaning that the properties aren't fixed. You can make up your own properties for the object, like Page.Title, Page.MyValue, or Page.MyDogIsADoofus, and assign values to them.

Some folks consider syntax like Page.Title to be cleaner than using something like PageData["Title"]. However, this isn't really the same as normal property syntax (e.g., Request.Forms), because the dynamic property isn't getting compile-time type checking. And when you're using a dynamic property, some operations that look like they should work don't, like this:

Page.MyCount = "3";
if(Page.MyCount.IsInt()){
    // Fail with compiler error. 
}

PageData["name"] [more]

Two small ASP.NET Web Pages (Razor) syntax tips

Wed, 11 Apr 2012 07:15:32 GMT

Two tips for Razor syntax: using a conditional attribute to set the selected attribute in a list item; working around a syntax restriction on x@x (e.g. <h@level>).

Tip 1
When I wrote recently about conditional attributes in ASP.NET Web Pages version 2 (new for that version), the example was the checked attribute of a checkbox. What about dynamically selecting an item in a <select> list?

I wanted the <select> list to remember the user’s choice after the page had been submitted. In an <input> element, you can do this by setting the value attribute to the appropriate item in the Request collection:

<input type="input" name="firstName" value="@Request.Form["firstName"]" />

In my case, I'm populating the <select> list from a database query (i.e. a collection) using a foreach loop. So I can use this code to compare each item against the user's most recent selection and set the selected attribute conditionally:

<select name="selectGenre">
   @foreach(var row in db.Query("Select DISTINCT Genre FROM Movies ORDER BY Genre")){
      <option 
          selected=@(row.Genre==Request.Form["selectGenre"])>
          @row.Genre
      </option>
   }
</select>

As each row is processed, I compare its Genre property/field against whatever was selected for the last page submission. If there's a match, the comparison returns true and the selected attribute is rendered.

[more]

Full list of new features for ASP.NET Web Pages v2 Beta

Wed, 14 Mar 2012 22:52:04 GMT

Ok, we've now got a list of the new features for ASP.NET Web Pages v2 posted. Here's a list of the stuff that's been added since the December 2011 preview, as recounted in the updated Top Features doc:

Conditional attributes. Described earlier.
Validation.GetHtml has been changed to Validation.For. This method renders the goo that's used to hook client-side validation. See earlier.
The ~ operator is now recognized in HTML markup, so you don't need to use Href any more to resolve it. See earlier. I think this is my favorite feature, actually, even tho some might consider it comparatively small, dunno.
The Scripts helper was renamed to Assets (aka the Assets Manager), and the method names were tweaked. If you were using Scripts to register scripts or .css files, you have to change those references.

The rest of the doc describes the features that are new in v2 generally, starting in the December preview. If you installed that preview, then you'll know all about those. :-)

New for ASP.NET Web Pages: Better ~ operator support

Wed, 07 Mar 2012 08:40:38 GMT

Another improvement in the Beta release of ASP.NET Web Pages v2 is better integration of the ~ operator. The ~ operator, as ASP.NET people know, resolves to the root path of the current website. (See also) This is handy for creating URL paths, because it means that a) you don't need to hard-code an absolute URL and b) it isn't relative to the location of the current page. You don't need to worry about how many folders up you need to count (e.g. ../../path) or about what happens if the current page moves.

In Web Pages v1 (as in all ASP.NET code), the ~ operator is supported. But it only works in server code; it's not supported in native HTML, so to speak. If you want to create a path that uses the ~ operator, you therefore have to wrap the path into something that tells ASP.NET that you've got server code. Inside of markup, we use the Href method. For example, to create an <a> link that incorporates it, you have to do this:

<a href="@Href("~/Default")">Home</a>

It works, but it's not very intuitive.

For v2 Beta, the .cshtml parser was enhanced so that it can recognize the ~ operator inline with normal markup. So the previous example can now be written like this:

<a href="~/Default">Home</a>

No need for the Href method any more. In .cshtml pages (not plain .html or .htm pages, of course), you really can treat the ~ [more]

New for ASP.NET Web Pages: Conditional attributes

Thu, 01 Mar 2012 14:07:57 GMT

The beta release of ASP.NET Web Pages has been released (for example, as part of the ASP.NET MVC 4 Beta release). There are only a few differences from the December 2011 Developer Preview release. (Details when we've got them posted.)

A very cool feature is what's being called conditional attributes. The idea is that in markup, you can set the value of an element's attribute to a variable or expression. If the variable or expression returns false or null, the entire attribute is not rendered. There are a variety of uses for this, but it does a great job of solving a problem we inherited from HTML 1.0 (I think it was).

The problem manifests in cases where the simple appearance of an attribute name — regardless of its value — is sufficient to trigger HTML behavior. One case is the checkbox, i.e., the <input type="checkbox"> element:

<input type="checkbox" name="check1" value="check1" checked />
<input type="checkbox" name="check1" value="check1" checked="true" />
<input type="checkbox" name="check1" value="check1" checked="anyThingAtAll" />

Notice that in the first one, the checked attribute doesn't even have a value. Nonetheless, all of these work the same, namely they produce checkbox that's selected.

There's a similar situation with items in a selection list:

<select>
   <option value="A">A</option>
   <option value="B" selected>B</option>
   <option value="C">C</option>
 </select>

Technically, to select item B, the tag should read <option value="B" selected="selected">, but just including the selected attribute works.

[more]

Updated validation in Web Pages v2, Part 3

Sat, 25 Feb 2012 21:41:05 GMT

As noted previously, to display validation errors in ASP.NET Web Pages v2, you can use Html.ValidationMessage and Html.ValidationSummary. You can use one or the other or both. If you use both, one idea is to use ValidationMessage to show an "error icon" and ValidationSummary to show the details:

Rather a plain display. However, you can style the output of the messages using some reserved CSS class names, to wit:

input-validation-error
field-validation-error
validation-summary-errors
field-validation-valid
input-validation-valid
validation-summary-valid

For example, to make a particularly forceful (if ugly) error display, define classes like this:

<style>
   .validation-summary-errors{
      border:2px solid red; 
      color:red; 
      font-weight:bold;
      padding:10px;
      margin:10px;
      width:30%}
   
   .field-validation-error{
      color:red; 
      font-weight:bold; 
      background-color:yellow;}
   
   .input-validation-error{
      color:red; 
      font-weight:bold; 
      background-color:pink;}
</style>

And when the errors appear, they will be noticeable:

Formatting Client-Side Validation Errors

[more]

Updated validation in Web Pages v2, Part 2

Wed, 15 Feb 2012 08:55:34 GMT

In the last post, I laid out the basics of the Validation helper that's introduced in ASP.NET Web Pages v2. As I noted then, the helper supports both server- and client-side validation. Here's how to implement the client side.

So, you've got a page that already does this:

In code, calls Validation.RequireField, Validation.RequireFields, or Validation.Add to register each input element for validation.

In code, calls Validation.IsValid to determine whether all validation checks have passed.

In markup, calls Html.ValidationMessage (for each validated element) and/or Html.ValidationSummary (once) to display any validation errors.

To add client functionality, you additionally do this:

Register the following JavaScript libraries in the page:
```
<script src="http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.6.2.js">
</script>
<script 
src="http://ajax.aspnetcdn.com/ajax/jquery.validate/1.8.1/jquery.validate.js">
</script>
<script src="@Href("~/Scripts/jquery.validate.unobtrusive.js")">
</script>
```
Two of the three libraries are loadable from a content delivery network (CDN), so you don't necessarily have to have them on your computer or server. However, you do have to have a local copy of jquery.validate.unobtrusive.js. For now, the easiest (if somewhat hacky) way to get this is to create a new Web Pages site based on one of the site templates (e.g. Starter Site). The site created by the template includes the jquery.validate.unobtrusive.js file in its Scripts folder, from which you can copy it to your site.

In markup, for each element that you're validating, add a call to ~~Validation.GetHtml(field)~~ [more]

Updated validation in Web Pages v2

Wed, 08 Feb 2012 20:45:45 GMT

In v1 of ASP.NET Web Pages, you could add user-input validation by doing something like this in code:

if (name.IsEmpty()) {
    ModelState.AddError("Name", "You must enter a name.");
}

In v2, there's a new Validation helper that has some nifty features:

Methods to check for required fields, data types, string length, numeric ranges, the same values in two fields (as for new passwords), and patterns (i.e., RegEx).
Methods to display both field-specific and summary validation error messages.
Both client-side (instant) and server-side (post-submit) validation. "A double dose of valid!" (#)

For client validation, you also get:

Unobtrusive JavaScript techniques to minimize client code in the file, relying instead on semantic attributes in the markup.
No submit until all values are valid.

You can use the Validation helper to provide only server-side validation or both client- and server-side checks. (You always get server validation, for security reasons.) The basic steps for server-side validation are:

Determine which input elements (fields) you want to validate

You typically validate values in <input> elements in a form. However, it is a good practice to validate all input, even input that comes from a constrained element like a <select> list, because users can bypass the controls on a page and submit a form.

Add individual validation checks for each input element (field)

In the page's code block, call one of the methods of the Validation helper that perform validation: RequireField, RequireFields, or Add. Pass to the method the name (the name [more]

WebMatrix and ASP.NET Web Pages books

Thu, 02 Feb 2012 10:50:40 GMT

We're quite happy to see a number of books about WebMatrix and ASP.NET Web Pages become available. Here is the list of books that I'm aware of at the moment:

Beginning ASP.NET Web Pages with WebMatrix
Mike Brind, Imar Spaanjaars. Mike is a superstar on the ASP.NET Web Pages forums.

Building ASP.NET Web Pages with WebMatrix (Need2Know)
Jim Wang. Jim is one of the testers on the ASP.NET team.

Building ASP.NET Web Pages with Microsoft WebMatrix (The Expert's Voice in .Net)
Steve Lydford (Update: see Steve's comment, including the bit about the open-source ecommerce sample that he's making available)

Introducing Microsoft® WebMatrix
Laurence Moroney

UBelly: A Guide to Web Development 101 Using WebMatrix
Andy Robb

There's also the PDF version of the tutorials that are on the http://asp.net/web-pages site.

[more]

Horizontal menu as a Razor helper

Wed, 01 Feb 2012 18:01:21 GMT

On the forums, someone was asking about creating a horizontal menu using Razor code in ASP.NET Web Pages. The technique of combining an unordered list (<ul> element) with CSS to create a horizontal layout, using <a> elements as the menu items, is a pretty well-known one; you can find examples here and here, not to mention in the Site.css file that comes with a lot of the Visual Studio web project templates.

The actual Razor part is likewise not hard. Someone showed this code as a way to dynamically build a list (to which you'd then apply the CSS):

<ul>
@foreach (var item in collection)
{
    <li>@item</li>
}
</ul>

The interesting part was a comment that the original poster made:

It sounds like if I have lots of logic inside the loop, I might be best served moving that to the back end somewhere and just calling a method that returns the text to display within each list item.

What this sounded like to me was a fun excuse to see about creating a custom helper. Helpers are, in effect, chunks of code and markup; when you invoke the helper, it runs the code and emits the markup. For example, by creating a helper to render a horizontal menu, you could do something like this in a page:

@MyHelpers.HorizontalMenu(
    "Home|Default.cshtml", 
    "About|About.cshtml", 
    "Login|Login.cshtml", 
    "Register|Register.cshtml")
<h1>My Page</h1>
      <p>Hello, horizontal menu.</p>

And get something like this:

Well, anyway, in the App_Code [more]

Need feedback: draft article about request validation

Mon, 23 Jan 2012 08:46:27 GMT

A couple of us on the ASP.NET documentation team are working on a topic that describes how to disable request validation in ASP.NET. What do you think about the following draft? Any feedback welcome.

Request validation is a feature in ASP.NET that examines an HTTP request and determines whether it contains potentially dangerous content. In this context, potentially dangerous content is any HTML markup or JavaScript code in the body, header, query string, or cookies of the request. ASP.NET performs this check because markup or code found in the URL query string, cookies, or posted form values might have been added to the request for malicious purposes.

For example, if your site has a form where users enter comments, a malicious user could enter JavaScript code in a <script> element. Then when you display the page with the comment to other users, the browser would execute that JavaScript code as if it had been generated by your website. This is commonly referred to as a cross-site scripting (XSS) attack.

Request validation helps prevent this kind of attack. If ASP.NET detects any markup or code in a request, it throws a "potentially dangerous value was detected " error and stops page processing. The default error page looks like this (click to enlarge):

Request validation throws this exception when any HTML markup is detected, including harmless markup like <b> [more]

Getting custom info from the FileUpload helper

Thu, 17 Nov 2011 14:25:50 GMT

In ASP.NET Web Pages, you can use the FileUpload helper[1] to render HTML that lets users upload one or more files. For example, this helper:

@FileUpload.GetHtml(
    initialNumberOfFiles: 1,
    allowMoreFilesToBeAdded: false,
    includeFormTag: true,
    uploadText: "Upload File 1",
    name: "Upload1"
)

Renders this:

The upload controls consist of a <input type="file"> element and a submit button (<input type="submit">). By default, the helper renders a <form> element around this. For example, the markup rendered by the previous example is this:

<form action="" enctype="multipart/form-data" method="post">
<div class="file-upload" id="file-upload-0">
<div>
    <input name="Upload1" type="file" />
</div>
</div>
<div class="file-upload-buttons">
    <input type="submit" value="Upload File 1" />
</div>
</form>

(The <div> elements with their IDs let you specify CSS to make things pretty.)

People sometimes ask whether there's a way to get additional information about the upload. For example, if you have two FileUpload helpers on a page, can you tell which one submitted the file?

Yes. Specify the helper this way:

<form method="post" name="form2" enctype="multipart/form-data">
	@FileUpload.GetHtml(
	    initialNumberOfFiles: 1,
	    allowMoreFilesToBeAdded: false,
	    includeFormTag: false,
	    uploadText: "Upload2",
	    name: "Upload2"
	)
	<input type="submit" name="buttonUpload2" value="Upload File 2" />
</form>

[more]

MembershipProvider error in ASP.NET Web Pages

Tue, 15 Nov 2011 22:23:45 GMT

If you use membership in ASP.NET Web Pages, you might get the error To call this method, the "Membership.Provider" property must be an instance of "ExtendedMembershipProvider":

I happened to run across this while playing around with the new OAuth login capabilities in the beta version of Web Pages 2, but you might see it under other conditions as well.

Per one of our testers, this can indicate that the server has no AspNetSqlMembershipProvider configured. (A clue here is that everything works great when you test locally, but then throws an error when you deploy to your hosting provider.)

In my case, I fixed this by adding the following to the site's local Web.config file:

<appSettings>
  <add key="enableSimpleMembership" value="true" />
</appSettings>

This is a child of the <configuration> element and a peer of the <system.web> element.

Anyway, that worked for me. I'm curious if others have seen this error and if so, how they fixed it.

Installing version 1 of WebMatrix after installing WM2 beta

Tue, 18 Oct 2011 08:36:26 GMT

The beta version of WebMatrix 2 was put out for public consumption around the time of the //build/ conference in September. Very nice.

However, installing WebMatrix 2 beta makes it harder to install (reinstall) the WebMatrix 1 (actually, 1.1), should you ever need to do that. (I did recently.) If you go to the download page and try to install the non-beta version of WebMatrix you won't get it, even if you carefully and explicitly don't choose the beta download option. You'll be offered WebMatrix 2 beta only.

Turns out this is due to the installer. WebMatrix is installed via Web Platform Installer (WebPI). When you install the Beta release, you first get an updated version of WebPI, and the updated version of WebPI knows only about the beta version of WebMatrix 2.

Anyway, long story short, if you've instaslled WebMatrix 2 Beta but for some reason need to reinstalled WebMatrix 1, you need to uninstall WebPI.

(Thanks to Chris Sfanos and his WebMatrix expertise for sorting this one out for me.)

Deploying Web Pages applications without a tool

Fri, 14 Oct 2011 13:06:39 GMT

The canonical way to deploy a Web Pages application to a remote server is to use the Publish facility of WebMatrix. (Or the publish facilities in Visual Studio, if that's what you're using.) Using a publish tool is nice, because it copies not just your application files (.cshtml pages, etc.), but also dependencies, notably the DLL files that are required for Web Pages (Razor) and the DLLs for SQL Server Compact, if needed.

But what if you cannot (or don't want to) use WebMatrix for deploying? You can still deploy using something like FTP, but it's then up to you to include the dependencies. This isn’t hard, it's just that you need to know what files to copy, from where, and where to put them.

To perform a manual FTP deploy, you copy everything from the website on your development computer (root folder + children) to the appropriate folder on the server. Copy all the .cshtml files, .html files, .css files, images, etc. (If you've got data in App_Data, there are additional considerations — see below.)

Then on the server, if there isn't already a bin folder under your app root, create one. (If you've installed NuGet packages, there probably already is a bin folder that contains the package files.) Copy everything that's in the following folder to the app's bin folder on the server:

C:\Program Files\Microsoft ASP.NET\ASP.NET Web Pages\v1.0\Assemblies

For a 64-bit machine, that's the Program Files (x86) folder.

This copies all the ASP.NET Web Pages assemblies — that is, the dependencies — to the server for this app. You need to copy the DLL files to the bin folder separately for each application that you deploy.

Deploying SQL Server Compact

[more]

Using Windows authentication in ASP.NET Web Pages

Tue, 16 Aug 2011 10:53:47 GMT

When I wrote about using simple membership in ASP.NET Web Pages a little while ago, commenter akshayms asked "How can I use Windows authentication"? Simple membership uses a login form and a membership database for managing a site's users. In contrast, Windows authentication just uses your existing Windows login credentials; no need to log in separately. Windows auth is useful for intranet sites, like on a corporate network.

When the question first came up, I asked around, because I hadn't played with it myself. The first answer was "Just like in 'normal' ASP.NET!", which is to say, by setting the authentication mode in the application's Web.config file to "Windows." (Documentation.) Like this:

<authentication mode="Windows" />

It turned out, tho, that this didn't entirely work. Anyway, long story short, it looks like you do this:

Disable simple membership.
Require authentication. (Duh, right? Hold that thought.)

(Windows authentication also needs to be enabled, but that's the default in ASP.NET, so you don't actually need to explicitly switch that on.)

You can do these by creating a Web.config file in the Web Pages application and adding the following to it. (Highlights for the interesting bits.)

<?xml version="1.0"?>
<configuration>
    <appSettings>
        <add key="EnableSimpleMembership" value="false" />
    </appSettings>
    <system.web>
        <compilation debug="false" targetFramework="4.0" />
        <authorization>
 [more]

Componentizing code in WebMatrix pages

Wed, 06 Jul 2011 01:12:15 GMT

At first glance, you might thing that in WebMatrix Razor (.cshtml, .vbhtml files) you have to put all your code into the page. For example, if you sift through pages created by the Starter Site template or look at tutorials (example), you'll see the code -- including data-access code -- all in one page.

Not so. WebMatrix websites are dynamically compiled. As such, you can work with them as with ASP.NET web sites -- specifically as with Visual Studio Web site projects. In particular, you can use shared code folders, which includes the Bin and App_Code folders. You can drop assemblies (.dll files) into the Bin folder, and they're automatically part of the site. Likewise you can put source-code files into the App_Code folder, and they'll likewise automatically be part of your site. This makes it quite possible (easy, even) to componentize code for your pages.

Here's a simple example. I've been messing around with creating a new blog from scratch using .cshtml pages.[1] I'm told that for SEO, the URL of an individual entry should include keywords that are separated (only) by hyphens, like this:

http://mysite/blog/an-example-blog-entry

You see this on popular blog engines (example, example). My thinking here is that I can take the blog entry title, whatever it might be, and use that as the basis for an ID.

[more]

"Potentially Dangerous" errors in ASP.NET Web Pages (Razor)

Wed, 29 Jun 2011 10:21:45 GMT

By default, ASP.NET performs request validation to prevent people from uploading HTML markup or script to your site. If someone includes markup in a page that they post to your site, ASP.NET throws a big ol' error:

"Potentially dangerous Request.Form value" is a little dramatic; ASP.NET throws this error for even innocuous stuff, like <b> and <em>.

There are times when it's ok to let people submit HTML. For example, if you let people comment on things in your site, maybe you want to let them format their comments.

Update 30 June 2011: Ok, h/t to a tweet about this post: before proceeding, make sure you have read and understand the very important note at the end. :-)

The error message suggests a remedy. However, if you're working with ASP.NET Web Pages (.cshtml or .vbhtml files), the information isn't really relevant, in two ways:

The proposed fix — add requestValidation="2.0" to the Web.config file — isn't necessary. Don't do this if you're working with only .cshtml/.vbhtml pages.
The actual fix isn't listed.

Instead, to accept HTML, you can use code like this:

@{
  var editedText = "";
  if(IsPost){
      editedText = Request.Unvalidated().Form["textbox1"];
  }
}

[more]

Moving a website in WebMatrix

Sat, 04 Jun 2011 10:05:54 GMT

I created a website in WebMatrix and decided later to move it to a different location. Since the site's files are all self-contained, I just moved them in Windows Explorer. However, when I opened up WebMatrix, I went to My Sites and clicked on the site:

However, this resulted in an error:

Of course. So the question is how to get WebMatrix to understand the site's new location. Turns out to be pretty easy. The site information is in the applicationhost.config file which is in turn in (here's the not-intuitive part) the My Documents\IISExpress\config folder.

This is an XML file that has a element containing a child element for each site that WebMatrix knows about. All I had to do was change the highlighted bit to point to the new location:

<site name="MotorcycleBlog" id="11">
  <application path="/">
    <virtualDirectory path="/" physicalPath="C:\MotorcycleBlog" />
  </application>
  <bindings>
    <binding protocol="http" bindingInformation="*:6867:localhost" />
  </bindings>
</site>

And thereafter WebMatrix opened the moved site from the correct location.

Constructing site URLs in ASP.NET Razor

Thu, 26 May 2011 23:25:40 GMT

The other day I showed how to send a confirmation email when people register on your site. In the example, I created a link that points to a confirmation page on my site, and I hard-coded the URL of that link. This isn't such a great idea; it makes the code non-portable should you decide to use it in a different site. If you only have one place in your site where you're constructing a link, maybe that isn't a huge problem, but in general, hard-coding things like your site's address will end up biting you. (Ask me how I know.)

There are a couple of ways to get around this.

Hard-coding in a central location

One approach is to go ahead and hard-code the site's URL, but to do it in only one central place where you can easily change it if you want to. (Semi-hard-coding it?) In ASP.NET Web Pages applications, you can do this in the _AppStart.cshtml (or _AppStart.vbhtml) file using the AppState object. This object just stores information that you want to have available anywhere in the site. This would be a typical way to store something global like the site's URL:

@{
    WebSecurity.InitializeDatabaseConnection("TestMembership",
       "UserProfile", 
       "UserId", 
       "Email", 
       true);

    WebMail.SmtpServer = "mySMTPServer";
    WebMail.EnableSsl = true;
    WebMail.UserName = "myUserName";
    WebMail.Password = "myPassword";
    WebMail.From = "mike@mikepope.com";
    
    AppState["siteURL"] = "http://www.mikepope.com/TestMembership/";
}

[more]

Using the confirmation feature for ASP.NET Web Pages security

Sun, 15 May 2011 22:47:06 GMT

When I described the most basic way to implement security (membership) for ASP.NET Web Pages/Razor websites, I skipped over a feature that you can add to the registration page — namely, confirmation for registration. You're undoubtedly familiar with how this works. You register on a site, and they say "Go check your email!" You get an email from them that requests that you click a link in order to finish the registration process. You do that, and then — but only then — you are allowed to log in.

This two-step process has a couple of benefits. One is that it helps to make sure that whoever is registering is actually a human and not a bot. In a sense, I suppose, it also helps make sure that people who register really want to register, since they need to go to some extra trouble. It also prevents people from registering multiple identities, since their user name is their (real) email name.

Adding confirmation to the registration process requires this:

In the registration page, you create the member account like normal by calling WebSecurity.CreateUserAndAccount, but you pass true for the requireConfirmationToken parameter.

The method creates the membership account and also returns a token to you. The token is a value (it might look like LR9888HmlCEkiL3/GdUY5g==) that uniquely identifies the new membership account. In the database record for the membership account, there's an IsConfirmed field that will be set to false. Because of this, the user cannot log in yet.

[more]