Programming ASP.NET 2.0 Krishna Kumar Academic Developer Evangelist Microsoft Corp.

Agenda Introduction to Web Development Module 1 – Architecture and Web Forms Module 2 – User Interface Elements Module 3 – Data Binding Module 4 – State Management Module 5 – Membership and Security Wrap Up

Introduction to Web Development Browser based Applications Little or no client install Platform independent Standards based – HTTP, [X]HTML Client Server Architecture ConventionalContemporaryHTTP Request (Verb, URI, Version, Headers, Body) Response (Status Code, Headers, Body)

Dynamic Web Content Dynamically generated HTML requires server host An engine that exposes an API to emit content Traditional hosts on Microsoft platform include: IIS with CGI IIS with ISAPI IIS with ASP IIS with ASP.NET

Module 1a – ASP.NET Architecture

Where does ASP.NET fit in?

Hosting ASP.NET with IIS6

Demo: Simple.aspx page

Page Compilation ASPX page is compiled upon first access Temporary ASP.NET files ASPX is a class Inherits from the Page class Server side script blocks are added to the class definition (member vars. & fns.) Interspersed script is added to a Render function (executable code) You work with ASP.NET by Building additional classes Extending Base classes Controlling class generation from.ASPX files Back to the DEMO

Code Behind Pages support inheritance from custom base class Base class specified with Inherits directive Promotes separation of code from presentation Three options for compiling code behind class Demand compiled using the ‘codefile’ directive and src placed in the same directory as the page Demand compiled and src placed in a directory named ~/App_Code at the top level of the application Precompiled and the assembly placed in a directory named ~/bin at the top level of the application Shadow Copy (~/bin assemblies) DEMO

Module 1b – Web Forms & Controls

Control Based programming Familiar Paradigm from desktop application development A program consists of a collection of controls Each control knows how to render to the screen The developer manipulates the state of these controls and lets rendering happen implicitly ASP.NET brings control based programming to web apps Server side objects created to represent elements of a page Each server side object capable of rendering as HTML Layered on top of HTTP’s Request/Response model Some desktop paradigms work well – others must be rethought

Demo: Control based.aspx page

Server side controls Server side controls: So called as they exist on the server and provide rendering to the client as HTML Created using ‘runat=server’ attribute on traditional HTML elements in a.aspx page Can be referenced within server side code using ID Implicitly added as member variables to the generated Page-derived class definition State Management Initial GET request creates controls with default values Subsequent POST back requests create controls and initialize them with values from the post body ViewState for non POSTable information

Page Lifecycle Each request to a page results in a new instance of that class Page goes through a lifecycle during request Exposes events that you can handle to interact with the page at various points during the request 5 primary events called in sequence during a page’s lifetime Possible to subscribe to these events in 3 ways Defining functions named Page_XXX with AutoEventWireup set to True Explicitly subscribing a delegate to that event Overriding virtual function handlers in base class

Event Sequence

Control Events Can handle control events in 2 ways: Declarative Event Subscription Indicating your handler function with the OnEvent attribute in the control’s tag Explicit Event Subscription Construct a new instance of the eventHandler delegate and initialize it with you handler function pointer Subscribe the delegate to the control’s event Hint: If using VS2005, just double click the control to get the event handler setup automatically

Detailed Event Sequence

User Controls User controls provide a simple way of defining composite controls You can take any.aspx page and turn it into a ‘user control’ User controls are defined in.ascx pages and use directive instead Using user controls Clients reference user controls using directive specifying the.ascx file in the Src attribute DEMO

Summary Prominence of Web Development HTTP pipeline / architecture ASP.NET architecture Page Compilation Demarcation between presentation and processing Controls based programming Page Lifecycle Event handling

Module 2 – User Interface Elements MasterPages, Themes, Skins and Navigation

Master Pages Application wide templates Partitioned into two blocks Blocks of HTML and code that apply to all pages Content blocks (ContentPlaceHolder ) ContentPlaceHolder are sections that are filled in by individual pages in the site Page designates the master via the MasterPageFile property Designer and IDE supported

Page before and after Master Page

Demo: Master Page Demo

Associating Pages Can have multiple Master Pages per site Associate each via MasterPageFile attribute To change via code, must be done before or during Page.PreInit Can configure all pages in a site to use one Master Page Pages element in Web.Config Will only apply to pages that use the correct content control declarations Individual pages can override Relative Paths Use the ASP.NET root path syntax (“~/ ”) ASP.NET will expand the URL to be correct relative from the local folder to the root of the application

Themes Theme: a great tool for consolidation of UI elements (CSS, Images, resources etc.) A named set of styles Each theme has a folder inside app_themes *Each CSS file in the theme folder embedded as a link in the rendered page* Applying a Theme Set via ‘Theme’ attribute in the Page directive Theme DEMO

Skins Another way to customize styles ‘CSS’ for ASP.NET Server side controls.skin files are placed inside the named Theme folders Can have multiple skin files in a folder Theme as a whole is applied by name A.skin file contains server side control declarations with default attributes Default skins and ID’d skins By default,.skin properties override local properties 'StyleSheetTheme' for the inverse Exempt controls or pages from themes with EnableTheming='false' Skins DEMO

Navigation Three new controls targeted at site navigation TreeView Hierarchical rendering with images and text Menu Both dynamic and static rendering supported SiteMapPath 'Breadcrumbs' control All three controls can use SiteMapProvider Default data source draws from web.sitemap Site map data (for page navigation) is kept in an XML file named “web.sitemap”

Demo: Navigation

How it all ties together… SiteMapDataSource uses the default SiteMapProvider Defaults to XmlSiteMapProvider implementation which reads XML data from web.sitemap file

Summary Master pages Standard implementation of templated pages Designer / runtime support Themes and skins Collection of pluggable UI elements Unify images,.css, and control declarations New navigation controls Standard implementations of Menu, Tree, and SiteMapPath Flexible, provider driven (or data source driven) UI is extremely customizable

Module 3 – Data Binding

Fundamentals Data binding is a process of populating a control with data from a data source Controls that support data binding expose- A property called DataSource A method called DataBind To bind data to a control, initialize its DataSource to a data source and invoke its DataBind method Page code can avoid looping over data

Data Source Controls

Declarative Data Binding Meant to reduce the amount of code written - data binding can now be accomplished with no code Declare everything needed Let framework do heavy lifting Declarative data source controls to access data source Declare how to select, update, instert and/or delete Can provide parameters Parameter sources declaratively chosen Extensive designer support Integration with server explorer Standard binding model easily customized

New Data Bound Controls GridView Displays a row in a table for each row from data source Supports automatic paging and sorting Repeater Displays multiple items for each row from data source Data and layout defined via templates DataList Displays one cell in table for each row from data source Data and layout defined via templates DetailsView Displays one row from data source Layout predefined in HTML table FormsView Displays one row from data source Data and layout defined via templates

Demo: Data Binding

New Data Bound Controls

Parameters Data source controls can accept parameters Parameter sources are declarative Values automatically read Parameter types depend upon source of value Parameter types ControlParameter Value retrieved from the property of any server control on the page CookieParameter Value retrieved from the cookie in request FormParameter Value retrieved from HTTP POST variable ProfileParameter Value retrieved from Client profile information QueryStringParameter Value retrieved from QueryString SessionParameter Value retrieved from Client Session

Parameters – SqlDataSource - Text Bound parameters can be used to populate any of the parameters in a data source Parameters most common along with accompanying expression

Templates Allows customization of databound controls Customize layout Customize data Customize layout by choosing markup in template Customize data by choosing data binding expressions for read only data for read only data for editable data for editable data Different templates for viewing, editing, inserting Well known CommandName to switch modes

Templates

Connection String Storage ConnectionStrings section in Web.Config New syntax for retrieving config file values

Summary Most controls in ASP.NET can have data bound to them Declarative model provides a higher order framework for data binding Declarative data sources Reduce code, move data access code into framework Data Binding Implicit with declarative data sources New rich data controls Several new controls including the GridView and DetailsView Parameters Each data source is completely customizable with parameters Templates New DataBinding Syntax – and New DataBinding Syntax – and Connection String storage New storage location in web.config

Module 4 – State Management

Client state Keeping track of client activity, as they move between different physical pages in your ASP.NET application How to accumulate and maintain state between page invocations Hard problem to solve since HTTP is a stateless protocol Various ways of storing state on behalf of clients SessionProfiles

Session State Session state is used to store individual data for a user during application transaction Session state is scoped by a single client session, and is tagged with a unique Session ID The session ID is transmitted between client and server using cookies (or mangled URLs if cookieless mode is enabled) Accessed through the Session property of the page, which references the current HttpSession object provided by the HTTP runtime Works regardless in both single page and multiple page programming models

Demo: Session

Improvements in session state in ASP.NET Several improvements to the way session state works in ASP.NET 2.0 Can avoid relying on cookies to track clients Cookieless mode of ‘autodetect’ Can configure to survive process shutdown Can configure to work across machines in a web farm Fully extensible provider based model Pluggable ID generator

Autodetect cookieless mode

Session key maintained with cookies

Session key maintained with URL Mangling

Profile Per-user data storage that is persistent Profile prover manages persistence Keys off of authenticated user Optionally supports anonymous users Supports strongly typed property data – usage easier than Sessions Working with profiles: Define the properties for the Profile inside web.config The above properties are now available as properties on the Profile property of the Page

Accessing profile information

Demo: Profile

Saving profile data Profile data is saved automatically Saved after every page request By default, a local SQL Server 2005 database file is generated (under App_Data) with ASP.NET tables to store profile and membership information

Migrating anonymous profile data Transition from unauthenticated to authenticated fires event Opportunity to transfer profile information from anonymous user to authenticated user

Summary Client State Management Sessions Session state is client-specific tied to browser session Profiles Is client-specific tied to authenticated user Can be tied to anonymous user

Module 5 – Membership and Security

Outline SecurityMembership Security Controls Membership Provider Role Provider

Security in ASP.NET ASP.NET provides security features in addition to those provided by IIS Oriented around client authentication Several method available for integrating authentication into your pages Managed through web.config Accessing authenticated client information The User property of the Page class provides access to current client information

Authentication and Authorization Authentication Modes Mode=NoneMode=WindowsMode=Forms Authorizing clients Authorization element used to describe which clients are granted access Supports sub elements allow and deny Users, roles, verbs ? represents anonymous * represents all clients The first match found (allow or deny) determines authorization

Windows Authentication Users credentials defined in active directory Leverage IIS to perform authentication IIS challenges browser by sending a 401 status code IIS forwards the username to ASP.NET

Forms Authentication Common approach for performing application-level authentication Application manages storage of credentials Application handles authentication FormsAuthentication class Credential Management and storage

Security ‘providers’ for common tasks Membership providers Works with xxMembershipProvider to simplify common tasks in building security infrastructure CreateUser DeleteUser ChangePassword ValidateUser Role providers xxRoleProvider implements common role-based authorization features CreateRole IsUserInRole GetAllRoles GetRolesForUser Several new controls generate large pieces of security UI

Example: Login control Building a login page now consists of:

How it works…

Where’s the data?

Membership controls Several new controls available that tap into the membership and role providers login authentication form alternate views based on identity password retrieval form (only with un-hashed passwords) Status and hyperlink to login/logout based on the state displays username for authenticated users form for entering new users form for changing password

Demo: Authentication Controls

Controls rely on provider

Role based authorization Useful to develop pages by querying the current client’s role membership Avoids hard coded user names checks Can be used interchangeably with windows group/user model through IPrincipal.IsInRole() DEMO

Summary IIS security sits on top of ASP.NET security ASP.NET provides a rich authentication framework ASP.NET enables site level management of security New membership provider + security controls Greatly simplifies building complex security UIs Common infrastructure to 'do it right' Pluggable Integrated role support

© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. Thank You. Please turn in the reviews!