Simple Talk is now part of the Redgate Community hub - find out why

Anti-Forgery Validation in ASP.NET Core

3
7
Hackers use the cross-site request forgery technique to grab the identity and privileges of legitimate authenticated users of a site to then perform any action that the victims have rights for. Without a way to detect this, the site will have no way to distinguish between a forged and legitimate request, ASP.NET has a robust defense if you remember to implement it, and Core introduces some other ways to ensure that this forgery can't succeed. … Read more
3
7

Revisiting Script Injection in ASP.NET

1
7
The danger of Cross-Site Scripting (XSS) has to be dealt with in any web application. You do this by validating the input from all possible channels. by constraining it in terms of its range, type and length, and by encoding the output from views. ASP.NET has some built-in validation of requests that can be extended to make it more effective, but this approach has changed with ASP.NET Core to place the onus on the application developers to provide the middleware to perform effective validation that is fine-tuned to the application. Dino Esposito explains.… Read more
1
7

Control the Controller in ASP.NET MVC

3
9
Because of its obvious importance in coordinating the MVC application, we tend to be wary of being too adventurous with it, but there are some interesting features that can sometimes be exploited to provide for less common requirements. The controller in ASP.NET MVC core, for example, can be a plain-old C# class (POCO), making it easier to create file-based content on the fly. The DefaultControllerFactory class can be changed, and you can override the GetControllerType method with a custom factory to give you localized routes and URLs. Dino explores some of the interesting internals of ASP.NET MVC controllers… Read more
3
9

Improvements to Model Binding in ASP.NET Core

4
16
Model Binding has been a popular feature of ASP.NET MVC, but has, before now, had some minor restrictions. ASP.NET Core now has enhanced model binding: If a value passed via routes, posted data, or query strings couldn't be bound appropriately, it forced a global exception. Now, there are a number of ways of providing a more graceful reaction to incorrect data. You can now force the binding to a given source or create new sources for binding to. Dino Esposito explains.… Read more
4
16

Model Binding in ASP.NET Core

4
14
Model binders work under the covers in ASP.Net MVC to provide the data for the action methods on a controller class. This data is held by the incoming HTTP request embedded into POST-ed form values, and maybe even the URL itself. Much magic is performed to get this right and, with some care, you can ensure that you can bind to object data, arrays and collections, as well as providing default values.… Read more
4
14

The Common Problems of Data Grids

4
7
Data grids are easy to do in HTML, and if we want anything complicated in terms of scrolling, locking and data entry, we usually shrug and buy a component to do it. However, there is a lot to be said for the approach of creating tables using a basic JavaScript platform such as jQuery, perhaps using a plugin which you can then customise. Dino talks you through this approach, showing how to take the DataTables plugin and implement locked columns, on-demand paging and filtering.… Read more
4
7

Printing from ASP.NET MVC

7
33
Even though we're less inclined to print web-pages nowadays, it often makes sense to save useful content from a website as a PDF file to read offline. Modern browsers give us everything we need to do that, and there is much that the website designer can do to improve the results. However, there are times that something more demanding is required, such as a properly-formatted invoice or chart, and then the web application needs a way of creating PDFs directly. … Read more
7
33

Pragmatic Web Error Handling in ASP.NET MVC

3
13
There is a pragmatic approach to error handling in ASP.NET MVC. This is the idea of recovering gracefully from those unhandled exception errors where remedial action cannot be taken under the current context, by passing control to a specified URL that is designed to deal with a particular category of application-specific error. Dino Esposito elaborates on a pattern that prevents unhandled exceptions from bubbling up well beyond the intended sco… Read more
3
13

The Advanced Uses of Razor Views in ASP.NET MVC

1
16
In ASP.NET MVC, Razor Views contain the HTML layout and the code that is combined with the data to be displayed in the final HTML. Dino continues his description of Razor Views by describing more advanced uses such as overridable views in multi-tenant applications and in-memory compilation of Razor templates to strings. … Read more
1
16

Multi-Step Input Forms in ASP.NET MVC

3
25
It is a common problem with a web page that a form is too complex to fit easily on the page. You can, of course, rely on the scrollbar, but it soon becomes a daunting and erratic process for the poor user. Wizards, that allow you to guide the user through a process, are great but take time to set up. Is there a simple solution for those occasions where there is too much data-entry for a form but a full wizard seems like overkill?… Read more
3
25

Taking Pictures from HTML

1
15
Sometimes a request from a user who doesn't appreciate the limitations of the technology can jolt you into discovering that an application feature that was, until recently, difficult to achieve is suddenly relatively easy. Dino was asked to allow the user to take photographs and associate them with an item of work. After he'd recovered from the shock, he decided that it was achievable, and now describes how he went on and did it.… Read more
1
15

Accepting Dates in Web Pages

3
4
Surely, not much could be simpler than using the HTML INPUT element? Actually, it was always a trouble for dates, what with having to check dates for validity and coping with all the languages and conventions. Now with HTML5, the 'date' type, and so many date-pickers that are either built-in or part of frameworks, it can become a complex decision about how you best deal with date input. Dino explains the issues of inputting dates into web applications.… Read more
3
4

Crossing the Site Domain with JavaScript

1
15
Browsers try to prevent a range of malicious attacks by preventing content being accessed by a web page from a different domain to the one that the page was fetched from. If you have a legitimate need to do this, it is a bad idea to disable this method of defence: Instead, there are more legitimate and safer ways of performing cross-domain JavaScript calls such as JSONP or Cross-Origin Resource Sharing, as Dino explains.… Read more
1
15

The Plain Simple Password Page Not So Simple Anymore

10
19
The requirements for the management of passwords have become far more complex over the past few years in response to the increasing sophistication of security breaches. Nowadays, you need to provide a range of features such as hashing, routine change of passwords, preventiion of repeat passwords, email confirmation, auto-generation of random passwords and password quality checks. Dino Esposito explains.… Read more
10
19

ASP.NET Core: A More Realistic Starter Kit

4
36
ASP.NET Core is a fascinating platform with many good ideas, but in its present form (RC1)there is a culture shock for experienced ASP.NET developers to experience the effort involved in porting a realistic application. There is an obvious advantage in being able to host an application on any web server, but is this enough to compensate for losing the convenience of an integrated pipeline?… Read more
4
36

Posting Form Content via JavaScript

4
4
Web-based applications run smoother if instead of using the traditional form method, they use JavaScript to post data to the server and to update the user interface after posting data: It also makes it easier to keep POST and GET actions separated. SignalR makes it even slicker; it can even update multiple pages at the same time. Is it time to use JavaScript to post data rather than posting via the browser the traditional way?… Read more
4
4

Keeping POST and GET Separated

4
19
The occasional problems that you can get with POST and GET are typical of the difficulties of separating any command and query operations. This separation is tricky to achieve, at least in ASP.NET MVC. Dino suggests some ways of avoiding errors and minimising the confusing warning messages.… Read more
4
19

Script Loading between HTTP/1.1 and HTTP/2

0
13
Web pages increasingly suffer from JavaScript-library bloat. Because it is difficult to avoid the awkward wait while these libraries load, there are some techniques for making the loading of these script files less evident to the page-load time. The introduction of HTTP/2 opens up further opportunities to defer script load or do it asynchronously in parallel. Dino explains.… Read more
0
13

How you log in to Simple Talk has changed

We now use Redgate ID (RGID). If you already have an RGID, we’ll try to match it to your account. If not, we’ll create one for you and connect it.

This won’t sign you up to anything or add you to any mailing lists. You can see our full privacy policy here.

Continue

Simple Talk now uses Redgate ID

If you already have a Redgate ID (RGID), sign in using your existing RGID credentials. If not, you can create one on the next screen.

This won’t sign you up to anything or add you to any mailing lists. You can see our full privacy policy here.

Continue