ASP.NET 4.0 in Practice DANIELE BOCHICCHIO STEFANO MOSTARDA MARCO DE SANCTIS MANNING Shelter Island For online information and ordering of this and other Manning books, please visit www.manning.com. The publisher offers discounts on this book when ordered in quantity. For more information, please contact Special Sales Department Manning Publications Co. 20 Baldwin Road PO Box 261 Shelter Island, NY 11964 Email: orders@manning.com ©2011 by Manning Publications Co. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by means electronic, mechanical, photocopying, or otherwise, without prior written permission of the publisher. Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in the book, and Manning Publications was aware of a trademark claim, the designations have been printed in initial caps or all caps. Recognizing the importance of preserving what has been written, it is Manning’s policy to have the books we publish printed on acid-free paper, and we exert our best efforts to that end. Recognizing also our responsibility to conserve the resources of our planet, Manning books are printed on paper that is at least 15 percent recycled and processed without the use of elemental chlorine. Manning Publications Co. Development editor: Cynthia Kane 20 Baldwin Road Copyeditor: Joan Celmer PO Box 261 Typesetter: Gordan Salinovic Shelter Island, NY 11964 Cover designer: Marija Tudor ISBN 9781935182467 Printed in the United States of America 12345678910–MAL –161514131211 v brief contents PART 1 ASP.NET FUNDAMENTALS 1 1 ■ Getting acquainted with ASP.NET 4.0 3 2 ■ Data access reloaded: Entity Framework 30 3 ■ Integrating Entity Framework and ASP.NET 52 PART 2 ASP.NET WEB FORMS 75 4 ■ Building the user interface with ASP.NET Web Forms 77 5 ■ Data binding in ASP.NET Web Forms 104 6 ■ Custom controls 135 7 ■ Taking control of markup 162 PART 3 ASP.NET MVC 185 8 ■ Introducing ASP.NET MVC 187 9 ■ Customizing and extending ASP.NET MVC 219 PART 4 SECURITY 257 10 ■ ASP.NET security 259 11 ■ ASP.NET authentication and authorization 282 BRIEF CONTENTS vi PART 5 ADVANCED TOPICS 317 12 ■ Ajax and RIAs with ASP.NET 4.0 319 13 ■ State 348 14 ■ Caching in ASP.NET 366 15 ■ Extreme ASP.NET 4.0 396 16 ■ Performance and optimizations 416 vii contents preface xv acknowledgments xvii about this book xix about the authors xxiii about the cover illustration xxv PART 1 ASP.NET FUNDAMENTALS 1 1 Getting acquainted with ASP.NET 4.0 3 1.1 Meet ASP.NET 4 1.2 Typical architecture in ASP.NET applications 7 1.3 Your first ASP.NET Web Form 13 1.4 What’s new in ASP.NET 4.0 17 1.5 ASP.NET Web Forms in practice 20 TECHNIQUE 1Handling PostBack 20 TECHNIQUE 2Form validation 23 TECHNIQUE 3Page header, styling, and CSS 26 1.6 Summary 28 CONTENTS viii 2 Data access reloaded: Entity Framework 30 2.1 Designing an application 31 2.2 Using an ORM to build a data layer 35 2.3 Introducing Entity Framework 37 TECHNIQUE 4Creating a model using Entity Framework 38 TECHNIQUE 5 Generating POCO code 41 TECHNIQUE 6Reading data using Entity Framework 43 TECHNIQUE 7 Writing data using Entity Framework 48 2.4 Summary 51 3 Integrating Entity Framework and ASP.NET 52 3.1 Understanding context lifetime 53 TECHNIQUE 8 First approach: one context per method 53 TECHNIQUE 9A better approach: one context per ASP.NET request 55 TECHNIQUE 10Instantiating the context using modules 58 3.2 Using the context the right way 59 TECHNIQUE 11Persisting entity modifications 60 TECHNIQUE 12Persisting only selected properties 61 TECHNIQUE 13 Persisting an entity using ViewState 65 TECHNIQUE 14Keep concurrency in mind 66 3.3 Optimizing performance in an ASP.NET environment 69 TECHNIQUE 15 Optimizing fetching 69 TECHNIQUE 16Avoiding multiple query execution 70 TECHNIQUE 17 Optimizing queries that retrieve a single element 71 TECHNIQUE 18Disabling change tracking 73 3.4 Summary 74 PART 2 ASP.NET WEB FORMS 75 4 Building the user interface with ASP.NET Web Forms 77 4.1 The UI and Web Forms 78 TECHNIQUE 19Better markup generation in ASP.NET 4.0 81 TECHNIQUE 20Controlling ClientID generation 83 4.2 Defining a common UI: using master pages 85 TECHNIQUE 21Using nested master pages 86 TECHNIQUE 22 Setting a master page programmatically 88 CONTENTS ix 4.3 URL rewriting and routing with ASP.NET 91 TECHNIQUE 23URL routing with Web Forms 93 TECHNIQUE 24Advanced URL routing scenarios 97 TECHNIQUE 25Rewriting in practice: UrlRewriting.NET 101 4.4 Summary 103 5 Data binding in ASP.NET Web Forms 104 5.1 Displaying data 105 TECHNIQUE 26 How to display data using Repeater 106 TECHNIQUE 27 ListView in ASP.NET 4.0 109 5.2 Modifying data 111 TECHNIQUE 28Using data source controls 111 TECHNIQUE 29EntityDataSource and Entity Framework 114 TECHNIQUE 30What’s new in GridView, FormView, and ListView 115 5.3 Filtering and sorting data 118 TECHNIQUE 31 The QueryExtender control 118 5.4 Working with Dynamic Data controls 123 TECHNIQUE 32 The first application 123 TECHNIQUE 33Working with metadata and templates 127 TECHNIQUE 34Extending Dynamic Data 131 5.5 Summary 134 6 Custom controls 135 6.1 The basics of custom controls 136 TECHNIQUE 35Simple controls 136 TECHNIQUE 36Composite controls 139 TECHNIQUE 37Handling PostBack 144 6.2 Complex controls 147 TECHNIQUE 38 Container controls 147 TECHNIQUE 39Templated controls 149 TECHNIQUE 40Data binding in custom controls 153 6.3 Advanced controls 156 TECHNIQUE 41 Control builders 156 6.4 Summary 161 7 Taking control of markup 162 7.1 ASP.NET adaptive rendering 163 TECHNIQUE 42Add OptionGroups to DropDownList 164 TECHNIQUE 43 Build a table-less control adapter for the DataList 170 CONTENTS x 7.2 ASP.NET 4.0 browser capabilities 177 TECHNIQUE 44Building a custom browser capabilities provider 178 TECHNIQUE 45Validating ASP.NET pages with the W3C validator 182 7.3 Summary 183 PART 3 ASP.NET MVC 185 8 Introducing ASP.NET MVC 187 8.1 A new way to build web applications 188 8.2 Your first experience with ASP.NET MVC 190 TECHNIQUE 46The model 191 TECHNIQUE 47The controller 194 TECHNIQUE 48The view 197 8.3 Routing in ASP.NET MVC 200 TECHNIQUE 49Partitioning using Areas 204 8.4 Accepting user input 207 TECHNIQUE 50 Handling user input at the controller level 207 TECHNIQUE 51 Validating posted data 212 8.5 Summary 217 9 Customizing and extending ASP.NET MVC 219 9.1 Building reusable elements in ASP.NET MVC 220 TECHNIQUE 52Building customized data templates 221 TECHNIQUE 53 Componentized markup through HTML helpers 226 TECHNIQUE 54Inject logic using action filters 229 9.2 User input handling made smart 235 TECHNIQUE 55 Custom model binders for domain entities 236 TECHNIQUE 56 Building a new model binder from scratch 243 9.3 Improving ASP.NET MVC routing 249 TECHNIQUE 57 Routes with consistent URL termination 249 9.4 Summary 255 CONTENTS xi PART 4 SECURITY 257 10 ASP.NET security 259 10.1 What is security in ASP.NET applications? 260 10.2 Filtering and blocking incoming requests 262 TECHNIQUE 58Handling improper parameter values 263 TECHNIQUE 59 Monitoring and blocking bad requests 264 10.3 Protecting applications from SQL injection 266 TECHNIQUE 60Handling SQL queries using parameters 267 TECHNIQUE 61 Dynamic queries with multiple values 269 10.4 Dealing with XSS (cross-site scripting) 271 TECHNIQUE 62 Handling and displaying user input 271 TECHNIQUE 63Using Microsoft’s Anti-XSS Library 275 10.5 Controlling path composition: path canonicalization vulnerabilities 278 TECHNIQUE 64 Dynamically building a path 278 10.6 Summary 281 11 ASP.NET authentication and authorization 282 11.1 Authentication and authorization basics 283 TECHNIQUE 65 Using FormsAuthentication and UrlAuthorization 284 11.2 Handling user authentication: introducing the Membership API 288 TECHNIQUE 66 Implementing a user login using the Membership API 289 11.3 Adding support to roles using the Roles API 294 TECHNIQUE 67 Implementing a role-enabled login using Roles API 294 11.4 Custom providers for the Membership and Roles APIs 298 TECHNIQUE 68 Other providers 298 TECHNIQUE 69 Building custom Membership and Role providers 300 TECHNIQUE 70Integrating Windows Live ID with your application 309 11.5 Summary 315 CONTENTS xii PART 5 ADVANCED TOPICS 317 12 Ajax and RIAs with ASP.NET 4.0 319 12.1 Understanding Ajax 320 12.2 Working with ASP.NET Ajax 323 TECHNIQUE 71Creating a classic page 323 TECHNIQUE 72 Ajaxize a page using the update panel 324 TECHNIQUE 73Optimizing UpdatePanel using triggers 326 TECHNIQUE 74 Optimizing a page with multiple UpdatePanels 327 TECHNIQUE 75Intercepting client-side pipeline 328 12.3 Focusing on the client: jQuery 330 TECHNIQUE 76Invoking REST web services with jQuery 336 TECHNIQUE 77 Invoking page methods with jQuery 339 TECHNIQUE 78 Invoking MVC actions with jQuery 341 TECHNIQUE 79Enriching the interface via jQueryUI 342 12.4 Summary 347 13 State 348 13.1 Handling state 349 TECHNIQUE 80Per-request state 349 TECHNIQUE 81Per-session state 351 13.2 Advanced user state 354 TECHNIQUE 82Using the Profile API 355 TECHNIQUE 83 A custom provider for the Profile API 359 13.3 Summary 365 14 Caching in ASP.NET 366 14.1 Per-application state: Cache 367 14.2 Using OutputCache 368 TECHNIQUE 84Leveraging OutputCache to speed up your pages 368 [...]... footing 3 4 CHAPTER 1 Getting acquainted with ASP.NET 4.0 You picked up this book because you want to get to know ASP.NET, specifically ASP.NET 4.0 Well, ASP.NET 4.0 isn’t a revolutionary release, but an evolutionary one In this book, we’ll focus on the new features you’ll find in version 4.0, but we’ll also cover material from the previous releases that’s still used in the 4.0 version In the beginning... highlighting important concepts In some cases, numbered bullets link to explanations that follow the listing Source code for all working examples in this book is available for download from the publisher’s website at www.manning.com /ASP.NET4 .0inPractice xxii ABOUT THIS BOOK Author Online The purchase of ASP.NET 4.0 in Practice includes free access to a private forum run by Manning Publications where you... 1.1.1 Installing ASP.NET ASP.NET 4.0 can run on top of Internet Information Services (IIS) 6.0 (Windows Server 2003), IIS 7.0 (Windows Server 2008 and Windows Vista), or IIS 7.5 (Windows Server 2008 R2 and Windows 7) ASP.NET uses Visual Studio as the integrated development environment (IDE) that it uses to create applications To start building applications based on ASP.NET, you first need to install... TECHNIQUE 98 16.4 Increasing performance with multithreading 427 Using ParallelFX 435 Optimize your web.config TECHNIQUE 99 Summary 439 417 Building a request filter to minify HTML 417 Building an HTTPHandler to minify CSS 422 Building an HTTPHandler to minify JavaScript 425 Reducing computing time with multithreading TECHNIQUE 16.3 416 Increasing download performance by minifying TECHNIQUE TECHNIQUE... Intercepting and handling mobile device requests 400 Logging and handling errors 402 TECHNIQUE 16 Implementing data caching in ASP.NET 381 Building custom cache providers TECHNIQUE TECHNIQUE 14.6 Deterministically removing items from OutputCache 372 OutputCache and partial views 378 93 Running your site from the database Summary 415 Performance and optimizations 16.1 94 95 96 97 TECHNIQUE 98 16.4 Increasing... as a guided tour through ASP.NET best practices; we’ll introduce each scenario, solve the problem, and then discuss the results Once you’ve read this book, you’ll have a better understanding of the most important aspects of designing, building, and maintaining ASP.NET- based applications You’re going to find many devices in this book that will help you in the learning process: ■ ■ ■ Figures—Pictures that... can use to do that ASP.NET MVC is a new option added in ASP.NET 3.5 SP1 and directly integrated into ASP.NET 4.0 as ASP.NET MVC 2.0 It’s not the new Web Forms, but rather a different approach to solve the same problem ASP.NET MVC lets you use the ModelView-Controller (MVC) pattern, and is built with testability and great markup control in mind Chapter 8 contains an introduction to ASP.NET MVC and shows... of the NET Framework initiative, which offered a unified environment in which to build and run applications for Windows developers If you think of NET Framework as a house, then ASP.NET is the rooms As ASP.NET approaches its fifth version (counting minor and major releases), the community of developers around ASP.NET is much more mature than it was ten years ago In the beginning, ASP.NET developers came... Part 1 ASP.NET Fundamentals W elcome to ASP.NET 4.0 In Practice, dear reader! ASP.NET was first introduced in the early 2000s as an effort from Microsoft to bring the easy development typical of Windows applications to the web From this first attempt, the web has changed a lot and so has ASP.NET Now ASP.NET is a mature framework that lets you create powerful applications This book is divided into four... see content that’s valuable in ASP.NET 3.5 or 2.0, but as we move further along, version 4.0 will be the main focus In this chapter, we’ll introduce you to what ASP.NET is, how it works, and how to get started We’ll look at the typical architecture of an ASP.NET application and then move into the new features you’ll find in the 4.0 release When that’s all said and done, we’ll introduce a problem-solution-discussion . 1 94 TECHNIQUE 48 The view 197 8.3 Routing in ASP. NET MVC 200 TECHNIQUE 49 Partitioning using Areas 2 04 8 .4 Accepting user input 207 TECHNIQUE 50 Handling user input at the controller level 207 . 93 TECHNIQUE 24Advanced URL routing scenarios 97 TECHNIQUE 25Rewriting in practice: UrlRewriting .NET 101 4. 4 Summary 103 5 Data binding in ASP. NET Web Forms 1 04 5.1 Displaying data 105 TECHNIQUE. 1 ASP. NET FUNDAMENTALS 1 1 Getting acquainted with ASP. NET 4. 0 3 1.1 Meet ASP. NET 4 1.2 Typical architecture in ASP. NET applications 7 1.3 Your first ASP. NET Web Form 13 1 .4 What’s new in ASP. NET