Shiju Varghese's Blog
Cloud First and Mobile First
-
Introduction to Test-Driven Development with ASP.NET MVC
One of the greatest advantages of ASP.NET MVC is the support of testability, which enables to Test-Driven Development (TDD) in an easy manner. A testable application should be developed in a loosely coupled manner so that you can test the independent parts of the application. For developing testable applications, the support of developer frameworks is very important and the frameworks should be designed to facilitate building testable applications. One of the design goals of ASP.NET MVC was testability so that you can easily develop testable application with the ASP.NET MVC framework. In this post, I will give an introduction to Test-Driven Development (TDD) with ASP.NET MVC using NUnit unit test framework.
-
T4 Template for generate Table Script from XSD
The below T4 template will generate Create Table script from a XSD file. The Template will create a dataset from a XSD file and generate create table script from the dataset.
-
Mini TechEd in Trivandrum
Kerala Microsoft user’s group (K-MUG) is organizing a Mini-TechEd in Trivandrum, India. Don’t miss this Free opportunity to learn about Windows 7, Visual Studio 2010 features, WPF, What is new in ASP.NET 4.0, SQL server best practices,SQL logical query execution and optimization tips,Hidden Gems in SQL Server.
-
Using .Net 3.5 and C# 3.0 features in T4 templates
The T4 templates are compiled against .Net Framework 2.0 by default and it will be restricted to use LINQ and other .Net 3.5 features in your T4 templates. If you want to use any of C# 3.0 or .Net 3.5 features in your T4 templates, you have to specify T4 templates language attribute is C#v3.5 instead of C#. The .Net 3.5 features are using System.Core namespace so that you have to give reference to System.Core namespace in the T4 templates.
The below is the syntax -
Applying Dependency Injection in ASP.NET MVC NerdDinner.com Application
ScottGu, Scott, Phil and Rob have announced a free ASP.NET MVC eBook and an open source ASP.NET MVC application Nerddinner.com. The free eBook is a single chapter of the Wrox’s upcoming title Professional ASP.NET MVC 1.0. The free eBook provides an end-to-end walkthrough of building NerdDinner.com application. The free eBook and the free Nerddinner application are extremely useful if anyone is trying to lean ASP.NET MVC. If you are a beginner to ASP.NET MVC, I highly recommend checking the eBook and the NerdDinner.com application. You can download the NerdDinner.com application from here.
-
ASP.NET MVC Tip: Add a new T4 template for making MVCContrib Grid Helper Component
In this tip, I demonstrate how you can add a T4 scaffolding template within the “Add View” dialog of the ASP.NET MVC Framework. I am creating a List scaffolding template for MVCContrib Grid helper component. Earlier, I have blogged about how to use MVCContrib Grid helper component but recently the component has changed a lot and introducing a fluent interface that provides a cleaner and more discoverable API. You can read all details from Jeremy Skinner's blog about the new enhancements of MVCContrib Grid helper component. I am creating the T4 template against the latest trunk of MVCContrib Grid helper.
-
ASP.NET MVC 1.0 Release Candidate (RC) Released
After 5 CTP versions and 1 Beta version, Microsoft has finally shipped Release Candidate version of ASP.NET MVC 1.0. You can download the RC version from here. One of the new features of ASP.NET MVC 1.0. is the scaffoldig support using Visual Studio's built-in T4. You can read full details from Scott Guthrie's blog post ASP.NET MVC 1.0 Release Candidate Now Available.
-
I Became Father
Tuesday, the 13th of January 2009, was the most memorable day in my life. I became a father for the first-time! My wife Rosmi and I were blessed with a baby girl. The name of the baby is Irene Rose Shiju. Both Rosmi and Irene are doing great.
-
xVal - An excellent validation framework for ASP.NET MVC
Steve Sanderson has developed an excellent validation framework for ASP.NET MVC. His validation framework xVal is an open-source project hosted on CodePlex. You can read more details from his blog post xVal - a validation framework for ASP.NET MVC
-
Secure ASP.NET MVC Applications
One of the greatest advantages of ASP.NET MVC is that it provides a "Close to the Metal" programming experience and you have full control over the HTML. It aslo means that you should care about the vulnerabilities regards with your HTML. In webform, server controls would be automatically HTML-encoded their outputs. While developing ASP.NET MVC apllications, you should filter your HTML to avoid XSS attacks. Use the following HTML helper methods to avoid vulnerabilities in your ASP.NET MVC applications.
Use Html.Encode to defense XSS
Use Html.Encode Helper method if you output user-supplied data.
Your search result for category : <%=Html.Encode(ViewData["Category"]) %>
Lets assume that if the user supplied "<script>alert('XSS')</script>" for input data , the Html.Encode will avoid to execute as a JavaScript function and will ensures to display that string as a literal text. When you using built-in Helper methods, It will automatically HTML-encode their outputs. As Rob Conery said, Html.Encode is not a silver bullet to avoid XSS
Use Html.AntiForgeryToken to defense Cross-Site Request Forgery (CSRF)
The Html.AntiForgeryToken helper method provides the support for detecting and defense CSRF attacks. This helper method available in Microsft ASP.NET MVC Futures assembly (Microsoft.Web.Mvc.dll). The assembly can download from http://www.codeplex.com/aspnet/Release/ProjectReleases.aspx?ReleaseId=18459 . Check the below example
<% Html.BeginForm("Save", "Category", FormMethod.Post); %>
<%= Html.AntiForgeryToken() %>
<% Html.EndForm(); %>
The AntiForgeryToken helper would generate a hiiden field named __MVC_AntiForgeryToken and gave a value that randomly generated for each user request. And at the same it gave cookie with name __MVC_AntiForgeryToken and the value would be constant for user session.
<form method="post" action="/Category/Save">
<input type="hidden" value="34/LV6nApPw0VWjxZkwY1imE8U8c+fAthll+ssF1fhbbK20HYA1EzXB6xaHqCHo4" name="__MVC_AntiForgeryToken"/>
</form>
The authorization filter atrribute [ValidateAntiForgeryToken] will check the all incoming request with form value __MVC_AntiForgeryToken and block the request if there is a invalid token is supplied. A CSRF attacker can't know the randomly generated value of AntiForgeryToken.
The below example used [ValidateAntiForgeryToken] in the controller action to validate the AntiForgeryToken.
[ValidateAntiForgeryToken]
public ActionResult Save(FormCollection form) {
}