ASP.NET Using Visual Basic

Transcription

1 ASP.NET Using Visual Basic Student Guide Revision 4.0 Object Innovations Course 4240

2 ASP.NET Using Visual Basic Rev. 4.0 Student Guide Information in this document is subject to change without notice. Companies, names and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Object Innovations. Product and company names mentioned herein are the trademarks or registered trademarks of their respective owners. Authors: Robert J. Oberg, Arun Ganesh, Srini Manickam is a registered trademark of Object Innovations. Special Thanks: Mark Bueno, Peter Thorsteinson, Sharman Staples, Ernani Cecon Junior, Dave Solum, Daniel Berglund Copyright 2010 Object Innovations Enterprises, LLC All rights reserved. Object Innovations Printed in the United States of America. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC ii

3 Table of Contents (Overview) Chapter 1 Introduction to ASP.NET Chapter 2 Web Forms Architecture Chapter 3 ASP.NET and HTTP Chapter 4 Web Applications Using Visual Studio Chapter 5 State Management and Web Applications Chapter 6 Server Controls Chapter 7 Caching in ASP.NET Chapter 8 ASP.NET Configuration and Security Fundamentals Chapter 9 Debugging, Diagnostics and Error Handling Chapter 10 More Server Controls Chapter 11 ADO.NET and LINQ Chapter 12 Data Access in ASP.NET 4.0 Chapter 13 Personalization and Security Chapter 14 ASP.NET AJAX Chapter 15 ASP.NET MVC Appendix A Appendix B Learning Resources HTTP Pipeline Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC iii

4 Directory Structure The course software installs to the root directory C:\OIC\AspVb. Example programs for each chapter are in named subdirectories of chapter directories Chap01, Chap02, and so on. The Labs directory contains one subdirectory for each lab, named after the lab number. Starter code is frequently supplied, and answers are provided in the chapter directories. The CaseStudy directory contains case studies in multiple steps. The Demos directory is provided for doing in-class demonstrations led by the instructor. Data files install to the directory C:\OIC\Data. Log files are written to the directory C:\OIC\Logs. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC iv

5 Table of Contents (Detailed) Chapter 1 Introduction to ASP.NET... 1 Web Application Fundamentals... 3 Setting up the Web Examples... 4 Benefits of ASP.NET... 8 ASP.NET Example Program... 9 An Echo Program ASP.NET Features Compiled Code Server Controls Browser Independence Separation of Code and Content State Management Lab Summary Chapter 2 Web Forms Architecture Web Forms Architecture Code-Behind Version of Echo Example HelloCodebehind.aspx HelloCodebehind.aspx.cs Page Class Code-Behind Inheritance Model Web Forms Page Life Cycle View State Enabling View State for Controls Web Forms Event Model Page Processing Page Events Page Properties Sample Program Page Directive Tracing Lab Summary Chapter 3 ASP.NET and HTTP Classical Web Programming Active Server Pages Object Model Request and Response Objects Request/Response in ASP.NET HttpRequest Class Properties of HttpRequest Using HttpRequest Class Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC v

6 HTTP Collections HttpResponse Class Redirect HttpUtility Echo Program Example Echo.aspx EchoBack.aspx GET and POST Compared QueryString and Form Collections Lab Summary Chapter 4 Web Applications Using Visual Studio Using Visual Studio Visual Web Developer Visual Web Developer Demo Starter Web Site ASP.NET Empty Web Site Adding a Web Form Using Components in ASP.NET Compilation Error Shadow Copying Shadow Copy Demonstration Temporary Copy of the Component ASP.NET Applications Global.asax Web Application Life Cycle Application Life Cycle Example Sample Log File Code in Global.asax Log Class Adding Global.asax File ListBox Data Binding Data Binding Code Example Items Collection XHTML XHTML in Visual Studio Absolute Positioning Lab Summary Chapter 5 State Management and Web Applications Session and Application State Example Program Session Object Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC vi

7 Page_Load Session Variable Issues Session State and Cookies Session State Timeout Session State Store Application State Implementing Application State Global.asax Users.aspx.cs Multithreading Issues Bouncing the Web Server Lab 5A Cookies Cookies and ASP.NET HttpCookie Properties Example Exposing Cookies Acme Travel Agency Case Study State Management Techniques Lab 5B Summary Chapter 6 Server Controls Server Controls in ASP.NET HTML Server Controls Using HTML Server Controls HTML vs. Web Forms Server Controls Server Control Examples HTML Controls Example Code for Login HTML Controls in Visual Studio Using HTML Controls Web Controls Validation Controls Required Field Validation Regular Expression Validation Rich Controls Copying a Web Site Lab User Controls Using a User Control Copyright.ascx Copyright.ascx.vb User Control Example Summary Chapter 7 Caching in ASP.NET Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC vii

8 Introduction What is Caching? Need for Caching (Why Cache?) Data to be Cached Time Frame ASP vs. ASP.NET Response Model Caching in ASP.NET Three Types of Caching in ASP.NET Output Caching... OutputCache Directive Simple Output Caching Example... OutputCache Attributes in Detail VaryByParam in Detail HttpCachePolicy Class HttpCachePolicy Class Example Page Fragment Caching Common Mistakes in Using Fragment Caching Fragment Caching Example Data Caching or Application Caching Add an Item to the Cache Object Insert and Add Methods Application Caching Example Expiration Problems in Caching Lab Summary Chapter 8 ASP.NET Configuration and Security Fundamentals One-minute Introduction to XML! ASP.NET Configuration - Overview Multi-level Configuration Configuration Hierarchy Example of Configuration Hierarchy Web.Config File Structure Web.Config Sections Application Settings ASP.NET Security Overview Role-Based Security and CAS Types and Steps Steps in Enabling Role-Based Security Three Ways to Authenticate Forms Authentication Example Forms Authentication Default.aspx Forms Authentication Web.Config Features of Forms Authentication Authentication Cookie Forms Authentication Classes Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC viii

9 Customizing Forms Authentication Authentication Source Forms Authentication Analysis Windows Authentication Windows Authentication Analysis Passport Authentication Passport Authentication - Analysis Authorization Lab Summary Chapter 9 Debugging, Diagnostics and Error Handling ASP.NET Diagnostics Debugging Using Visual Studio Calculator Example Debugging Calculator Application-Level Tracing Tracing Calculator Using the Page Cache Single Page Example Preparing to Debug Trace Messages Tracing the Calculator Page Conditional Tracing Trace Category Trace Warning Exceptions in Trace Errors in ASP.NET Uncaught Exception Custom Error Pages Lab Summary Chapter 10 More Server Controls ASP.NET Control Improvements Newer Controls in ASP.NET Master Pages Master Page Demonstration Creating Content Pages TreeView Control Master Page Application Lab Summary Chapter 11 ADO.NET and LINQ ADO.NET ADO.NET Architecture Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC ix

10 .NET Data Providers ADO.NET Interfaces NET Namespaces Connected Data Access AcmePub Database Creating a Connection Using Server Explorer Performing Queries ADO.NET with ASP.NET Web Client Isolation Web Client Database Code Using Commands Creating a Command Object Using a Data Reader Data Reader: Code Example Use of Session State Generic Collections Executing Commands Parameterized Queries Parameterized Query Example Lab 11A DataSet DataSet Architecture Why DataSet? DataSet Components DataAdapter DataSet Example Program Data Access Class Retrieving the Data Filling a DataSet Accessing a DataSet Using a Standalone DataTable DataTable Update Example Adding a New Row Searching and Updating a Row Deleting a Row Row Versions Row State Iterating Through DataRows Command Builders Updating a Database Language Integrated Query (LINQ) Bridging Objects and Data LINQ Demo Object Relational Designer Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC x

11 IntelliSense Basic LINQ Query Operators Obtaining a Data Source LINQ Query Example Filtering Ordering Aggregation Obtaining Lists and Arrays Deferred Execution Modifying a Data Source Performing Inserts via LINQ to SQL Performing Deletes via LINQ to SQL Performing Updates via LINQ to SQL Lab 11B Summary Chapter 12 Data Access in ASP.NET Data Access in ASP.NET Data Access Demonstration Data Entry Demonstration SQL Generation Options Enable Edit and Delete Editing Records GridView Control DetailsView Control Storing the Connection String Protecting the Configuration String Lab 12A FormView Control Master/Detail Web Pages Data Binding Template Editing Using XML Data Example Program XML Data Source Demo Multiple-Tier Data Access Object Data Source Lab 12B Data Access in ASP.NET ListView Demonstration Using the Entity Data Model EntityDataSource Control ListView Edit DataPager Control LinqDataSource Control Configuring LinqDataSource Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC xi

12 QueryExtender Control QueryExtender Example Summary Chapter 13 Personalization and Security Themes Control Skins Sample Skin File Applying Themes Example of Themes Security in ASP.NET ASP.NET Membership Login Controls Membership Demonstration Web Site Administration Tool Access Rules Login Controls Demo Running the Membership Demo Lab 13A Profile Properties Profile Demonstration Using ASP.NET Profile Properties Lab 13B Summary Chapter 14 ASP.NET AJAX Desktop Applications Web Applications Plug-Ins Client-Side Scripting JavaScript Example Script Code JavaScript in ASP.NET Dynamic Pages Efficient Page Redraws AJAX Google Maps ASP.NET AJAX Partial Page Rendering Partial Page Rendering Example UpdatePanel Control AJAX Extensions Controls UpdatePanel Demo AJAX Client Library Using the Client Library ScriptManager Control Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC xii

13 Client Library Namespaces Sys.Debug Tracing Simple Client Library Example Document Object Model JavaScript for Simple Calculator Using the Client Library AJAX Control Toolkit ACT Controls in Visual Studio ACT Sample Web Site AjaxControlToolkit.dll Registering AjaxControlToolkit.dll Extender Controls NumericUpDownExtender Control Lab Summary Chapter 15 ASP.NET MVC Model-View-Controller (MVC) What Is ASP.NET MVC? Advantages of ASP.NET MVC Advantages of Web Forms Visual Studio ASP.NET MVC Project Starter Application Simple App with Controller Only Action Methods and Routing Action Method Return Type Rendering a View Creating a View in Visual Studio The View Web Page Passing Data from Controller to View Embedded Scripts Embedded Script Example Using a Model Controller Using the Model View Using the Model Strongly-Typed View Strongly-Typed View in Visual Studio Using Forms HTML Helper Functions Displaying Sign In Form Handling Form Submission Model Binding Greet View Input Validation Nullable Type Checking Model Validity Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC xiii

14 Validation Summary Lab Summary Appendix A Learning Resources Appendix B HTTP Pipeline Web Applications Customizing the HTTP Pipeline Customizing Applications Customizing a Welcome Application Logger Class Custom Handlers IHttpHandler Interface Custom Handler Example ashx Files Custom Modules Example: DemoModule Using DemoModule Using IIS Summary Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC xiv

15 AspVb Chapter 1 Chapter 1 Introduction to ASP.NET Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 1

16 AspVb Chapter 1 Introduction to ASP.NET Objectives After completing this unit you will be able to: Review the fundamentals of Web applications and set up a testbed using Internet Information Services and ASP.NET. Explain the benefits of ASP.NET. Describe the programming models provided by ASP.NET: Web Forms, Web services and MVC. Create a simple Web Forms application using the.net Framework SDK. Outline the principal features of ASP.NET. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 2

17 AspVb Chapter 1 Web Application Fundamentals A Web application consists of document and code pages in various formats. The simplest kind of document is a static HTML page, which contains information that will be formatted and displayed by a Web browser. An HTML page may also contain hyperlinks to other HTML pages. A hyperlink (or just link ) contains an address, or a Uniform Resource Locator (URL), specifying where the target document is located. The resulting combination of content and links is sometimes called hypertext and provides easy navigation to a vast amount of information on the World Wide Web. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 3

18 AspVb Chapter 1 Setting up the Web Examples All the example programs for this chapter are in the chapter folder Chap01 underneath the root folder \OIC\AspVb. One way to run the examples is to have Internet Information Services (IIS) installed on your system. You will have to explicitly install it with Windows 7 and Windows XP. The management tool for IIS is a Microsoft Management Console (MMC) snap-in, the Internet Services Manager, which you can find under Administrative Tools in the Control Panel. You may run also run the ASP.NET examples using the built-in ASP.NET Development Server. This built-in Web server is started automatically from within Visual Studio 2010 and is discussed in Chapter 4. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 4

19 AspVb Chapter 1 IIS Manager The figure shows the main window of the Internet Services Manager for IIS 7, which comes with Windows 7. You can Start and Stop the Web server and perform other tasks from the Manage Web Site group. With Advanced Settings you can change the physical path of the Default Web Site, which by default is located at \inetpub\wwwroot on the drive where Windows is installed. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 5

20 AspVb Chapter 1 Virtual Directory You can access Web pages stored at any location on your hard drive by creating a virtual directory. Click Add Virtual Directory. You can enter the desired alias, which will be the name of the virtual directory. Browse to the desired physical path and click OK. The figure shows creating an alias AspVb for the folder \OIC\AspVb. You should perform this operation now on your own system so that you may follow along as the course examples are discussed. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 6

21 AspVb Chapter 1 Home Page for ASP.NET Examples Once a virtual directory has been created, you can access files in it by including the virtual directory in the path of the URL. In particular, you can access the file default.htm using the URL The file default.htm contains a home page for all the ASP.NET example programs for the course. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 7

22 AspVb Chapter 1 Benefits of ASP.NET You can use compiled, object-oriented languages with ASP.NET, including C# and Visual Basic. All the power of the.net Framework is available to you, including the extensive class library. Code and presentation elements can be cleanly separated. Code can be provided in a separate section of a Web page from user interface elements. The separation can be carried a step further by use of separate code behind files. ASP.NET comes with an extensive set of server controls that provide significant functionality out of the box. Server controls transparently handle browser compatibility issues. Configuration is handled by XML files without need of any registry settings, and deployment can be done simply by copying files. Visual Studio provides a very powerful and easy-touse environment for developing and debugging Web applications. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 8

23 AspVb Chapter 1 ASP.NET Example Program We examine an example, Hello.aspx, in detail. The example is complete in one file and contains embedded server code. ASP.NET pages have an.aspx extension. The source code consists of HTML along with some C# script code. There are also some special tags for server controls, recognized by ASP.NET. <!-- Hello.aspx --> <%@ Page Language="vb" %> <html> <head> <title>hello</title> <script runat="server"> Sub cmdecho_click(byval source As Object, _ ByVal e As EventArgs) lblgreeting.text="hello, " & txtname.text End Sub </script> </head> <body> <form runat="server">your name: <asp:textbox ID="txtName" runat="server"> </asp:textbox> <p><asp:button ID="cmdEcho" OnClick="cmdEcho_Click" Text="Echo" runat="server" tooltip="click to echo your name"> </asp:button></p> <asp:label ID="lblGreeting" runat="server"></asp:label> </form> </body> </html> Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 9

24 AspVb Chapter 1 An Echo Program You can run the program using the URL or by clicking on the link Chap01/Hello.aspx in the home page of the examples programs. The page shows a text box where you can type in your name, and there is an Echo button. Clicking the button will echo your name back, with a Hello greeting. The simple form is again displayed, so you could try out other names. If you slide the browser s mouse cursor over the button, you will see the tool tip Click to echo your name displayed in a yellow box. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 10

25 AspVb Chapter 1 An Echo Program (Cont d) The figure illustrates a run of this example. This little program would not be completely trivial to implement with other Web application tools, including ASP. The key user interface feature of such an application is its thoroughly forms-based nature. The user is presented with a form and interacts with the form. The server does some processing, and the user continues to see the same form. This UI model is second nature in desktop applications but is not so common in Web applications. Typically, the Web server will send back a different page. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 11

26 AspVb Chapter 1 An Echo Program (Cont d) This kind of application could certainly be implemented using a technology like ASP, but the code would be a little ugly. The server would need to synthesize a new page that looked like the old page, creating the HTML tags for the original page, plus extra information sent back (such as the greeting shown at the bottom in our echo example). A mechanism is needed to remember the current data that is displayed in the controls in the form. Another feature of this Web application is that it does some client-side processing too the Echo button s tooltip displayed in a yellow box is performed by the browser. Such rich client-side processing can be performed by modern browsers, such as Internet Explorer and Firefox. As can be seen by the example code, with ASP.NET it is very easy to implement this kind of Web application. We will study the code in detail later. For now, just observe how easy it is! Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 12

27 AspVb Chapter 1 ASP.NET Features ASP.NET provides a programming model and infrastructure that facilitates developing new classes of Web applications. Part of this infrastructure is the.net runtime and framework. Server-side code is written in.net compiled languages. Two main programming models for Web pages are supported by ASP.NET. Web Forms helps you build form-based Web pages. A WYSIWYG development environment enables you to drag controls onto Web pages. Special server-side controls present the programmer with an event model similar to what is provided by controls in ordinary Windows programming. ASP.NET MVC is a newer framework that provides an alternative to Web Forms for creating Web applications. It is based on the Model-View-Controller design pattern. ASP.NET MVC is introduced in the last chapter of this course. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 13

28 AspVb Chapter 1 ASP.NET Features (Cont d) ASP.NET also supports Web Services, which make it possible for a Web site to expose functionality via an API that can be called remotely by other applications. Data is exchanged using standard Web protocols and formats such as HTTP and XML, which will cross firewalls. A newer technology, Windows Communication Foundation, is now preferred for implementing Web services. Web Forms, ASP.NET MVC, and ASP.NET Web services can all take advantage of the facilities provided by.net, such as the compiled code and.net runtime. In addition, ASP.NET itself provides a number of infrastructure services, including: state management security configuration caching tracing Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 14

29 AspVb Chapter 1 Compiled Code Web Forms can be written in any.net language that that is compatible with the common language runtime, including C# and Visual Basic. This code is compiled, and thus offers better performance than ASP pages with code written in an interpreted scripting language such as VBScript. Compilation normally occurs at HTTP request time, and subsequent accesses to the page do not require compilation. The ASP.NET compilation model is described in the next chapter. All of the benefits, such as a managed execution environment, are available to this code, and of course the entire.net Framework Class Library is available. Legacy unmanaged code can be called through the.net interoperability services. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 15

30 AspVb Chapter 1 Server Controls ASP.NET provides a significant innovation known as server controls. These controls have special tags such as <asp:textbox>. Server-side code interacts with these controls, and the ASP.NET runtime generates straight HTML that is sent to the Web browser. The result is a programming model that is easy to use and yet produces standard HTML that can run in any browser. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 16

31 AspVb Chapter 1 Browser Independence Although the World Wide Web is built on standards, the unfortunate fact of life is that browsers are not compatible and have special features. A Web page designer then has the unattractive options of either writing to a lowest common denominator of browser, or else writing special code for different browsers. Server controls help remove some of this pain. ASP.NET takes care of browser compatibility issues when it generates code for a server control. If the requesting browser is upscale, the generated HTML can take advantage of these features, otherwise the generated code will be vanilla HTML. ASP.NET takes care of detecting the type of browser. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 17

32 AspVb Chapter 1 Separation of Code and Content Typical ASP pages have a mixture of scripting code interspersed with HTML elements. In ASP.NET there can be a clean separation between code and presentation content. The server code can be isolated within a single <script runat="server">... / script> block or, even better, placed within a code behind page. We will discuss "code-behind" pages in the next chapter. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 18

33 AspVb Chapter 1 State Management HTTP is a stateless protocol. Thus, if a user enters information in various controls on a form, and sends this filled-out form to the server, the information will be lost if the form is displayed again, unless the Web application provides special code to preserve this state. ASP.NET makes this kind of state preservation totally transparent. There are also convenient facilities for managing other types of session and application state. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 19

34 AspVb Chapter 1 Lab 1 A Mortgage Calculator Web Page You have received a consulting contract to add useful functionality to a realtor s Web site. In this lab you will implement the first feature, which is a Web page that can be used to calculate a mortgage payment. Detailed instructions are contained in the Lab 1 write-up at the end of the chapter. Suggested time: 30 minutes Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 20

35 AspVb Chapter 1 Summary ASP.NET is a unified Web development platform that greatly simplifies the implementation of sophisticated Web applications. ASP.NET supports two programming models for Web pages, Web Forms and ASP.NET MVC. Server controls present the programmer with an event model similar to what is provided by controls in ordinary Windows programming. Other features of ASP.NET include: Compiled code Browser independence Separation of code and content State management Security Configuration Tracing Caching Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 21

36 AspVb Chapter 1 Introduction Lab 1 A Mortgage Calculator Web Page You have received a consulting contract to add useful functionality to a realtor s web site. In this lab you will implement the first feature, which is a Web page that can be used to calculate a mortgage payment. The screen capture shows the completed Web page with a sample calculation. Suggested Time: 30 minutes Root Directory: OIC\AspVb Directories: Labs\Lab1 Chap01\Hello.aspx Chap01\MortgageCalculator (do your work here) (starter file) (console mortgage calculator) Files: Chap01\Mortgage.aspx (answer) 1. As a starter file, copy the file Hello.aspx into Labs\Lab1 and rename as Mortgage.aspx. You should now be able to access the echo page through the URL Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 22

37 AspVb Chapter 1 2. Change the title to Mortgage Calculator. 3. Create the user interface for your Web mortgage calculator by making two copies of the textbox for the name in Hello. Rename the three textboxes, one button and one label appropriately. Rename the button handler to match the new name of the button. 4. Examine the code for the VB console program in the MortgageCalculator folder. Run this program a couple of times to generate some test data for use in testing your Web mortgage calculator. 5. Implement the event handler for the Calculate button by copying in code from the MortgageCalculator project. For the Web version you will obtain a numerical value by using the Convert class. For example, decimal amount ' amount of mortgage... amount = Convert.ToDecimal(txtAmount.Text) 6. After you have calculated calcpymt, display it formatted as currency in the label lblpayment. You can do the formatting by the String.Format method. lblpayment.text = String.Format("{0, 8:C}", calcpymt) 7. Save your file and test it in the browser. Try out the test data obtained from running the console version of the program. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 23

38 AspVb Chapter 1 Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 24

39 AspVb Chapter 13 Chapter 13 Personalization and Security Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 457

40 AspVb Chapter 13 Personalization and Security Objectives After completing this unit you will be able to: Use themes and skins to customize the look of pages and controls. Use the ASP.NET membership system to validate and store user credentials. Implement membership in your applications by using the ASP.NET Login control. Customize the behavior of your Web application for individual users through the use of profiles. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 458

41 AspVb Chapter 13 Themes A theme is a collection of property settings that enable you to specify the appearance of pages and controls. Using themes you can achieve consistency in look and feel across a Web application or a portion of a Web application. You can apply theme settings to: An entire Web site A page with all its controls Individual controls You define a theme for your application by a collection of skin files that reside in a subfolder of the App_Themes folder of your application. The skin files define settings for individual types of controls. The name of the folder containing the skin files is used as the name of the theme. An application can have multiple themes, which are used in different parts of the application. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 459

42 AspVb Chapter 13 Control Skins Control skins (or just skins) specify settings for individual controls such as Button, Label, and so on. Typically you will define a control skin for each type of control that you use in an application. You set the control properties in the skin so that the controls have a similar look. There are two types of control skins: A default skin applies to all controls of the same type. A named skin has a SkinId property. A named skin is applied to a specific control by the control specifying the SkinId of the skin. Skins are defined in files with the extension.skin. The name of the file has no significance to the application using the skin. The application only refers to named themes, and to specific SkinIds. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 460

43 AspVb Chapter 13 Sample Skin File See the Foo.skin file in the YellowTheme folder in the ThemeDemo example program for this chapter. This file defines two default skins and one named skin. <asp:label runat="server" ForeColor="red" Font-Size="14pt" Font-Names="Verdana" /> <asp:button runat="server" borderstyle="solid" borderwidth="3px" bordercolor="red" backcolor="yellow"/> <asp:button runat="server" SkinId="StandardButton"/> Note that the properties specified, such as ForeColor, Font-Size, and so on, all pertain to the visual appearance of a control. The specific properties that you can set via a theme are defined by the control itself. Such properties are called themable. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 461

44 AspVb Chapter 13 Applying Themes To apply a theme across an entire application, specify the theme in the Web.config file. <configuration> <system.web> <pages theme="yellowtheme" /> </system.web> </configuration> You can also apply a theme to an individual page. In Page directive set the Theme attribute to the name of the theme to be used on the page. This setting will override a theme that has been set for the whole application. <%@ Page Language="vb" AutoEventWireup="true" CodeFile="Default.aspx.vb" Inherits="_Default" Theme="GreenTheme" %> Finally, you can apply a particular named skin from a theme to an individual control, overriding the page and application themes. <asp:button ID="Button3" runat="server" Text="Button" SkinID="StandardButton" /> Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 462

45 AspVb Chapter 13 Example of Themes The program ThemeDemo illustrates the use of themes. Two themes are defined. YellowTheme is applied to the whole application, which consists of three pages. GreenTheme is applied to the page Default.aspx. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 463

46 AspVb Chapter 13 Example of Themes (Cont d) The application-wide theme YellowTheme applies to AnotherPage.aspx. YellowTheme also applies to the page ThirdPage.aspx. But on this page, the last control overrides the page theme by using the SkinId of a named skin. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 464

47 AspVb Chapter 13 Security in ASP.NET 4.0 Security is a key consideration in modern Web applications. The foundation of security is authentication, which concerns determining the identity of the user or process requesting a service. Authentication answers the question: Who are you? It is achieved by comparing the configured user ID and password with the user provided ID and password. There are several authentication mechanisms supported by ASP.NET, but the most important is Forms Authentication. It redirects unauthenticated users to a specific URL, which challenges the user to provide credentials. If authenticated, the user is issued a token, which is then passed back in the header of every successive request. ASP.NET 4.0 greatly facilitates managing authentication through a Membership system. A powerful set of Login controls integrates with the Membership system to provide a robust solution for user membership and access control, requiring little or no code for a basic implementation. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 465

48 AspVb Chapter 13 ASP.NET Membership ASP.NET Membership provides a built-in way to store and validate user credentials. A SQL Server database is typically used to store user information. ASP.NET Membership integrates with the Login controls for a solution that is extremely easy to use. ASP.NET Membership includes facilities to: Create new users and passwords Store membership information in a SQL Server database or another data store Authenticate users who visit the Web site Manage passwords, include support for features such as maintaining a password reminder The Membership system can also integrate with other parts of ASP.NET, such as User Profile and Web Parts. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 466

49 AspVb Chapter 13 Login Controls The Membership system provides an API you can code against, but a very robust solution to many practical problems can be achieved with little or no code by employing the built-in Login Controls. The CreateUserWizard control collects user information and creates a corresponding account in the Membership system. The Login control is used at runtime to authenticate a user who presents a user name and password. The LoginStatus control presents a user interface offering the user a means to log in or log out, depending on the user s status. The LoginName control displays the login name of a user who is logged in. The LoginView control displays different information depending on whether a user is logged in. Templates are provided for specifying what is to be displayed in each state. PasswordRecovery and ChangePassword controls support various features for user password management. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 467

50 AspVb Chapter 13 Membership Demonstration As with much else in ASP.NET, the best way to understand the capabilities of the Membership system is through a hands-on demo. Little or no coding is required, but you must go through a number of operations in Visual Web Developer. The MemberDemo program has three basic features: A home page Default.aspx that is accessible to anyone. A members page Members.aspx that is only accessible to logged in members. A login system that manages membership and lets user log in and log out. 1. Use Visual Web Developer to create a new ASP.NET Empty Web Site 1 MemberDemo in the Demos directory. 2. Add a new Web Form Default.aspx. Provide a title. Switch to Design View. Enter heading Home Page using <H2> style. 3. In Solution Explorer, right-click over your Web site and add a regular folder named MembersOnly. 4. Add a page Members.aspx to this folder, with code in a separate file. Enter <H2> text Members Page. Also, provide a hyperlink to the home page. 5. Add a hyperlink on the home page that links to the members page. 1 An ASP.NET Web Site will provide login functionality automatically. In this demo we are adding the functionality ourselves for instructional purposes. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 468

51 AspVb Chapter 13 Web Site Administration Tool 6. Set Default.aspx as the Start Page. 7. From Website menu choose ASP.NET Configuration. 8. Click the Security tab. 9. Click on the link Use the security Setup Wizard to configure security step by step. 10. Proceed to Step 2 and select From the Internet. Click Next. 11. Proceed to Step 5, not changing anything in Steps 3 and 4. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 469

52 AspVb Chapter 13 Web Site Admin Tool (Cont d) 12. Enter John Doe for the user and John&Doe for the password. (The use of the ampersand and mixed upper and lower case will ensure a strong password. It will also be easy to remember for testing purposes!) Enter any data you wish for address, security question and security answer Click Create User, Continue, and then Next. 2 If you have trouble creating a user from within the wizard, you can use the Create User link from the main page of the Security tab. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 470

53 AspVb Chapter 13 Access Rules 14. In Step 6, expand the MemberDemo folder and select the MembersOnly folder we created. 15. For Rule applies to select Anonymous Users. For Permssion select Deny. This rule will prevent users who are not logged in from accessing any pages in the MembersOnly folder. 16. Click Add This Rule and then Finish. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 471

54 AspVb Chapter 13 Membership Demonstration (Cont d) 17. Try running the application at this point. You can bring up the home page OK, but if you click on the link to the members page, you will get an error, because you are not logged in. Note that the error message is not too specific: no gratuitous aid to hackers! Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 472

55 AspVb Chapter 13 Login Controls Demo We will now use several of the Login controls to implement a basic Login mechanism. 1. From the Login group of the Toolbox, drag a LoginStatus control onto your home page. Note that this has two views, one for a Logged Out state and another for a Logged In state. 2. For the Logged Out state a link is provided to a page named Login.aspx. Add such a page to your Web site. 3. Open this new page in Design View, and drag a Login control onto the page. 4. From the Validation group of controls, drag a ValidationSummary control onto the page. 5. Set the ValidationGroup property of this control to Login1, the ID of the Login control. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 473

56 AspVb Chapter 13 Running the Membership Demo 1. Now run your application again. The home page is displayed. 2. Click on the Members Page link. 3. You are challenged by the Login page. Enter the valid John Doe / John&Doe user name and password and click the Log In button. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 474

57 AspVb Chapter 13 Membership Demo (Cont d) 4. Now you will be brought to the Members page. 5. Click the link to the home page. The LoginStatus control now gives you an opportunity to log out. 6. Experiment some more. Try logging out, and then logging in from the home page. Also, try some invalid logins, and see the error messages that are displayed. You are now at Step 1. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 475

58 AspVb Chapter 13 Lab 13A An Enhanced Membership Demo In this lab you will enhance the Membership Demo program to support some additional features: Display additional information for logged in or logged out users. Provide a registration page for adding new users. Detailed instructions are contained in the Lab 13A write-up at the end of the chapter. Suggested time: 30 minutes Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 476

59 AspVb Chapter 13 Profile Properties A common requirement for a Web application is to store and utilize information that is unique to a particular user. When this user visits the site, she can be presented with a personalized version of the Web site. This kind of application personalization requires a number of elements: Store the information using a unique user identifier Recognize users when they visit again Fetch the personalized user information The ASP.NET Profile system provides a persistent storage facility and API to support this kind of personalization. By default, a SQL Server 2008 database is used. You do not need your own database. The system supports storing any data type, both simple and complex. Both anonymous and logged-in users can be supported. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 477

60 AspVb Chapter 13 Profile Demonstration The example program ProfileDemo illustrates the ASP.NET Profile system. You can store the user s country as a string. You can store a list of favorite fruits as an ArrayList. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 478

61 AspVb Chapter 13 Using ASP.NET Profile Properties You specify profile properties in the application s configuration file. Note that you must be using Forms authentication. If you want to store properties for anonymous users, you must so indicate in the configuration file. <system.web> <authentication mode="forms" /> <anonymousidentification enabled="true" /> <profile> <properties> <add name="country" type="system.string" allowanonymous="true" /> <add name="fruits" type="system.collections.arraylist" allowanonymous="true" /> </properties> </profile> </system.web> You can access the profile properties in a strongly typed manner as properties of the Profile object. Protected Sub Page_Load(ByVal sender As Object, _ ByVal e As System.EventArgs) Handles Me.Load If Not IsPostBack Then lblcountry.text = Profile.Country ShowFavoriteFruits() End If End Sub Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 479

62 AspVb Chapter 13 Using Profile Properties (Cont d) You may also set profile properties by simple assignment. Protected Sub btnremember_click(byval sender As _ Object, ByVal e As System.EventArgs) _ Handles btnremember.click Profile.Country = _ Server.HtmlEncode(txtCountry.Text) lblcountry.text = Profile.Country End Sub You may also work with complex data types, such as collections, as profile properties. Protected Sub btnaddfruit_click(byval sender As _ Object, ByVal e As System.EventArgs) _ Handles btnaddfruit.click Dim fruit As String = _ Server.HtmlEncode(txtFruit.Text) If Profile.Fruits Is Nothing Then Profile.Fruits = New ArrayList() End If Profile.Fruits.Add(fruit) ShowFavoriteFruits() End Sub Private Sub ShowFavoriteFruits() ddfruit.datasource = Profile.Fruits ddfruit.databind() End Sub Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 480

63 AspVb Chapter 13 Lab 13B Concluding Acme Publishing Case Study In this lab you will conclude the Acme Publishing case study by adding a number of additional features to your application: A My Account page for Acme customers A membership system so that only registered customers can access the My Account page A login system allowing customers to login to the site A registration page for adding new customers Display of personalized information on the My Account page showing the book categories of interest to the customer. Detailed instructions are contained in the Lab 13B write-up at the end of the chapter. Suggested time: 75 minutes Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 481

64 AspVb Chapter 13 Summary You can use themes and skins to customize the look of pages and controls. With the ASP.NET membership system you can validate and store user credentials. ASP.NET provides a suite of Login controls that you can use to implement membership in your applications. You can customize the behavior of your Web application for individual users through the use of profiles. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 482

65 AspVb Chapter 13 Introduction Lab 13A An Enhanced Membership Demo In this lab you will enhance the Membership Demo program to support some additional features: Display additional information for logged in or logged out users. Provide a registration page for adding new users.. Suggested Time: 30 minutes Root Directory: OIC\AspVb Directories: Demos\MemberDemo Labs\Lab13A\MemberDemo Chap13\MemberDemo\Step1 Chap13\MemberDemo\Step2 (continue your work here) (alternate work area) (backup of starter code) (answer) Additional Information for Logged In or Logged Out Users 1. If you did not complete the demo, do so now. Alternatively, you may work with the starter code that is provided. Run your starting application to make sure that the basic member functionality is working. 2. Use Server Explorer to take a peek at the SQL Server database created for you. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 483

66 AspVb Chapter Open Default.aspx in Design View, and drag a LoginView control onto the page. 4. The Anonymous Template is open. This template lets you provide content that users will see when they are not logged in. Provide the following text: Please click the Login link to log in. If you don t have an account, click the Register link. 5. Now select the LoggedIn Template. Provide this text: You are logged in. 6. In Members.aspx provide the static text Welcome followed by a LoginName control. 7. Run your application. You should see appropriate messages displayed on the home page, depending on whether you are logged in or not. If you are logged in, you will also see a welcome message in the members page. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 484

67 AspVb Chapter 13 Registration Page 1. Add a new page Register.aspx to your project. 2. Provide <H2> style text Please Register. 3. Drag a CreateUserWizard control onto your page. 4. In the Properties window, set ContinueDestinationPageUrl to Default.aspx. 5. Drag a ValidationSummary control onto the page, and set the ValidationGroup property to CreateUserWizard1. 6. Add a hyperlink to the home page. 7. On the home page provide a hyperlink to the registration page. 8. Test your enhanced demonstration program. You should now be able to register additional users. You can also use the ASP.NET Website Administration Tool to manage the users you created dynamically. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 485

68 AspVb Chapter 13 Introduction Lab 13B Concluding Acme Publishing Case Study In this lab you will conclude the Acme Publishing case study by adding a number of additional features to your application: A My Account page for Acme customers A membership system so that only registered customers can access the My Account page A login system allowing customers to login to the site A registration page for adding new customers Display of personalized information on the My Account page showing the book categories of interest to the customer. Suggested Time: 75 minutes Root Directory: OIC\AspVb Directories: Labs\Lab13B\AcmePub Labs\Lab12B\AcmePub CaseStudy\AcmePub\Step3 CaseStudy\AcmePub\Step4 (work area) (your previous version) (backup of starting code) (answer) Part 1: My Account Page for Acme Customers In Part 1 you will add a new page, My Account, intended to be used exclusively by Acme customers. A link to this page will be provided in the side menu of the master page. In the preliminary implementation, the new page will be accessible by anyone. 1. If you prefer to work with your own code from Lab 11B, delete the provided starter code and copy your work from Lab 11B. Otherwise, just use the supplied starter code. 2. Run the application in the work area and verify that the three pages of the application are functioning properly. 3. In Solution Explorer, right-click over your Web site and add a regular folder named Customers. 4. Add a page MyAccount.aspx to this folder, with <H2> text Welcome followed by a space. The new page should have code in a separate file and use the master page AcmeMaster.master. 5. Add a hyperlink in the menu of the master page that links to the My Account page. The new menu item should be positioned just above the link to Home. Rev. 4.0 Copyright 2010 Object Innovations Enterprises, LLC 486