Module 7: Building Web Applications

Transcription

1 Module 7: Building Web Applications Contents Overview 1 Introduction to ASP.NET 2 Creating Web Form Applications 16 Demonstration: Creating Web Forms 30 Lab 7.1: Creating the Customer Logon Web Forms 31 Building Web Services 42 Demonstration: Creating a Web Service 50 Using Web Services 51 Demonstration: Using a Web Service 57 Multimedia: How Web Services Work 58 Lab 7.2: Creating and Using the CustomerService Web Service 60 Review 71

2 Information in this document, including URL and other Internet Web site references, is subject to change without notice. Unless otherwise noted, the example companies, organizations, products, domain names, addresses, logos, people, places and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, address, logo, person, place or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property Microsoft Corporation. All rights reserved. Microsoft, MS-DOS, Windows, Windows NT, ActiveX, BizTalk, FrontPage, IntelliSense, JScript, Microsoft Press, Outlook, PowerPoint, Visio, Visual Basic, Visual C++, Visual C#, Visual InterDev, Visual J#, Visual SourceSafe, Visual Studio, and Windows Media are either registered trademarks or trademarks of Microsoft Corporation in the U.S.A. and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.

3 Module 7: Building Web Applications iii Instructor Notes Presentation: 120 Minutes Labs: 105 Minutes This module provides students with the knowledge needed to create Web-based applications. In the first lab, students will create several Web Forms for logging on or registering as a customer of the Cargo system. In the second lab, students will create a Web Service that provides information about customers and allows the addition of new customers to the system. The labs use predefined classes that replicate data storage and retrieval. After completing this module, students will be able to: Explain and take advantage of the benefits of ASP.NET and its various libraries in application development. Create Web Form applications. Use HTML server controls and Web server controls. Create Web Services. Materials and Preparation Use Web Services from a browser or from another client application. This lesson provides the materials and preparation tasks that you need to teach this module. Required Materials To teach this module, you need the following materials: Microsoft PowerPoint file 2373B_07.ppt Module 7, Building Web Applications Lab 7.1, Creating the Customer LogOn Web Forms Lab 7.2, Creating and Using the CustomerService Web Service Multimedia presentation, How Web Services Work, file 2373_How Web Services Work.htm on the Student Materials compact disc Preparation Tasks To prepare for this module, you should: Read all of the materials for this module. Read the instructor notes and the margin notes for the module. Practice the demonstrations. Complete the labs.

4 iv Module 7: Building Web Applications Demonstrations This section provides demonstration procedures that will not fit in the margin notes or are not appropriate for the student notes. These demonstrations show the creation of simple Web Forms and simple Web Services. If students have previous experience with ASP.NET Beta 1, consider using validation controls in the Web Forms demonstration, and analyze the client-side proxy files generated in the Using a Web Service demonstration. Creating Web Forms To create the application 1. Open Microsoft Visual Studio.NET. 2. Create a new ASP.NET Web Application project called LogonDemo in the following Web directory: 3. Examine the Web.config file, and locate the authentication and sessionstate sections, pointing out the default values. To create the logon page 1. Open the WebForm1.aspx file in the design window. 2. In the Properties window, change the Document.pageLayout property to FlowLayout. 3. Click the top left corner of the Web Form to create a heading, and in the Block Format list on the Formatting toolbar, click Heading Add the text Welcome to the Logon Page to the page. 5. Using the Web Forms toolbox, add the following controls to the page, and then set their properties as shown in the table. Control type Property Value TextBox (ID) txtfullname TextBox (ID) txt TextBox (ID) txtpassword TextMode Password TextBox (ID) txtconfirm TextMode Password Button (ID) btnsubmit Text Submit 6. To describe the purpose of each TextBox, add Normal style text above each box, as shown in the following table. TextBox Describing text txtfullname txt txtpassword txtconfirm Please enter your full name: Please enter your address: Please enter a password: Please confirm the password:

5 Module 7: Building Web Applications v 7. Reposition the controls on your page as shown in the following illustration: 8. Examine the WebForm1.aspx file in the HTML view of the HTML Designer, and describe Page directive at the top of the page and the HTML syntax within the page, including the control declarations. 9. In the design window, double-click btnsubmit to display the Code Editor, and then explain the code in this module. 10. Add the following code to the btnsubmit_click event handler, and then explain the uses of the session variable and Response object. Session("FullName") = txtfullname.text Response.Redirect("Welcome.aspx") To create the welcome page 1. Add another Web Form named Welcome.aspx to the project, add a single Label control to it, and then set the (ID) property of the control to lblwelcome. 2. Locate the Page_Load event handler in the Welcome.aspx.vb code module, and add the following code: lblwelcome.text = "Welcome " & Session("FullName") To test the application 1. Run the application. 2. Type values in the text boxes, and then click Submit, viewing the results. 3. Quit the application. 4. Quit Visual Studio.NET.

6 vi Module 7: Building Web Applications Creating a Web Service To create the application 1. Open Visual Studio.NET. 2. Create a new ASP.NET Web Service project in the following directory: 3. Using the Solution Explorer, delete Service1.asmx from the project. Add a new Web Service item named QueryUsers.asmx. To create the GetUserName method 1. Open the QueryUsers.asmx.vb code module and add the following method: <WebMethod( )> Public Function GetUserName( _ ByVal As String) As String Return & ": Corresponding name on database" End Function 2. Build the project, but do not run it. To test the Web Service 1. Right-click QueryUsers.asmx in Solution Explorer, and then click View in Browser. 2. Click the GetUserName hyperlink and examine the HTML description page. Enter an address in the input field for the GetUserName method and click Invoke and view the Extensible Markup Language (XML) results. Close this window. 3. Return to the first HTML description page, and click the Service Description link to view the Web Services Description Language (WSDL) document. Describe the document, briefly pointing out the basic sections of the document before closing the window. To add descriptions to the Web Service and methods 1. In the QueryUsers.asmx.vb code module, modify the class definition to read as follows: <WebService(Namespace := " _ Description:="This service deals with user information.")> Public Class QueryUsers 2. Locate the GetUserName method and modify the WebMethod attribute to read as follows: <WebMethod(Description:="Looks up a name based on the .")> 3. To display the new HTML description page, rebuild the project and view QueryUsers.asmx in the browser as before, pointing out the new descriptions. 4. Close Visual Studio.NET.

7 Module 7: Building Web Applications vii Delivery Tip This demonstration uses the Web Service from the previous demonstration. If you have not created the web service, you must open Services.sln in install folder\democode\mod07\ Services\Solution and build the project. Then you can substitute Services/Solution for Services/Starter/Services in the folder paths in this demonstration. Delivery Tip In step 6, do not go into too much detail regarding the proxy class file. Students can explore this individually if they want to. Using a Web Service To test a Web Service with Internet Explorer 1. Open Microsoft Internet Explorer. 2. Type the following Uniform Resource Locator (URL) into the Address bar of Internet Explorer to demonstrate how browsers can submit a call which includes parameters to the Web Service methods: Starter/Services/QueryUsers.asmx/GetUserName? =Jeff 3. Close Internet Explorer. To use a Web Service from a rich client 1. Open the RichClient.sln solution in the install folder\democode\ Mod07\RichClient\Starter folder. 2. View the form design for frmuserdetails.vb. The purpose of the form is to retrieve user details based on an address by means of the Web Service. 3. On the Project menu, click Add Web Reference, and then type in the following URL: Starter/Services/QueryUsers.asmx 4. Click the Go to button, and then click Add Reference. 5. Locate the localhost Web reference in Solution Explorer, and rename it UserServices. 6. In Solution Explorer, click Show All Files and view the Reference.vb file that acts as the proxy class for the client application. Explain that this file allows client code to be written as if it were normal Visual Basic.NET code, allowing the use of Microsoft IntelliSense and early binding. 7. Create the btnsubmit_click event handler in frmuserdetails.vb, and add the following code, explaining the purpose of each line. Dim qu As New UserServices.QueryUsers( ) MessageBox.Show(qu.GetUserName(txt .Text), _ "Result from the Service") qu = Nothing To test the client application 1. Run the project. 2. Click Submit to view the results of the call to the Web Service. 3. Exit the form and the Visual Studio.NET integrated development environment (IDE).

8 viii Module 7: Building Web Applications Multimedia Presentation This section provides multimedia presentation procedures that do not fit in the margin notes or are not appropriate for the student notes. How Web Services Work To show the multimedia presentation To show this presentation, double-click the animation icon on the slide for the Multimedia: How Web Services Work topic. Module Strategy Use the following strategy to present this module: Introduction to ASP.NET This lesson introduces ASP.NET and shows some of the benefits over Active Server Pages (ASP). Emphasize that this is primarily an overview lesson; most of these topics are addressed in more detail throughout the module. For more in-depth information about ASP.NET, refer students to Course 2063A, Introduction to ASP.NET. Creating Web Form Applications This lesson shows how to create Web Forms applications. Students examine the structure of a Web Form, including some of the important directives that are used within the page definition. Compare HTML controls to Web server controls, and highlight some individual controls for discussion, such as the validation controls and the AdRotator control. Finally, introduce students to event handling for ASP.NET server controls. Building Web Services This lesson describes the open standards and protocols that enable Web Services, in addition to how to create Web Services and their methods by using the WebMethod attribute. The student notes show how to include method and Web Service descriptions within these attributes. Point these lessons out to students. Use the instructor-led demonstration to show students how to create a simple Web Service and its discovery document. Using Web Services In this lesson, you examine how to use a Web Service from a client, including the process of discovery and the exploration of service descriptions. Explain to students how they can access this information from a browser and from a rich client such as Visual Basic.NET. Use the demonstration and animation at the end of the module to give students examples of possible scenarios for Web Services, and elicit suggestions for other Web Services from the students.

9 Module 7: Building Web Applications 1 Overview Topic Objective To provide an overview of the module topics and objectives. Lead-in In this module, you will learn about building Web applications with Visual Basic.NET. Introduction to ASP.NET Creating Web Form Applications Building Web Services Using Web Services *****************************ILLEGAL FOR NON-TRAINER USE****************************** Using Microsoft Visual Basic.NET and ASP.NET, you can create a new generation of dynamic, powerful Web applications. Delivery Tip Developers who are familiar with the ASP model will find the transition to ASP.NET to be fairly easy. After completing this module, you will be able to: Explain and take advantage of the benefits of ASP.NET and its various libraries in application development. Create Web Form applications. Use HTML server controls and Web server controls. Create Web Services. Use Web Services from a browser or from another client application.

10 2 Module 7: Building Web Applications Introduction to ASP.NET Topic Objective To provide an overview of the topics covered in this lesson. Lead-in ASP.NET introduces many improvements upon traditional approaches to Web development. Overview of ASP.NET Using Response and Request Objects Maintaining Client-Side State Maintaining Server-Side State Managing an ASP.NET Application Overview of ASP.NET Security Using Global Events with Global.asax *****************************ILLEGAL FOR NON-TRAINER USE****************************** Delivery Tip This lesson provides an overview of ASP.NET and its benefits without going into much detail about any one topic. Most items are covered in more depth later in the module. ASP.NET introduces many improvements upon traditional approaches to Web development. Its extensive framework of classes enables you to rapidly create powerful, scalable, manageable, and secure Internet applications. After you complete this lesson, you will be able to: Describe the advantages that ASP.NET provides over its predecessor, Active Server Pages (ASP). Use two important ASP.NET objects: Request and Response. Use the various client-side and server-side state facilities that are available in ASP.NET applications. Explain basic concepts in managing and securing ASP.NET applications. Use the Global.asax application file for global events.

11 Module 7: Building Web Applications 3 Overview of ASP.NET Topic Objective To discuss the key features provided by ASP.NET. Lead-in ASP.NET introduces many significant enhancements to ASP. Code behind development Intuitive approach to development similar to Windows Forms Code can be compiled using any.net-compatible language Significant performance improvement ASP.NET pages run side-by-side with ASP pages Files with the.aspx extension run side-by-side with current ASP applications on IIS Automatic support for multiple browsers Rich DHTML, HTML 3.2, and small devices ASP.NET namespaces provide rich functionality Built-in support for Web Services *****************************ILLEGAL FOR NON-TRAINER USE****************************** For several years, Web developers have used ASP to produce Internet applications containing dynamic content. ASP.NET is the evolution of this technology, and it provides many benefits to Web developers: Code-behind support ASP.NET uses an event-driven programming model familiar to Visual Basic and ASP developers. Web Forms use the drag-and-drop style of page creation. You can modify code behind the controls on Web Forms in the same way that you do on Visual Basic forms. This code resides in a separate file to separate the content from the code. Code can be compiled from any Microsoft.NET-compatible language You can create your ASP.NET applications by using any of the.net compatible languages, including Visual Basic.NET, C#, and Microsoft JScript. While ASP contains scripts that are interpreted when you execute a page, ASP.NET code is compiled rather than interpreted. This allows early binding, strong typing, and just-in-time (JIT) compilation to native code. These factors greatly improve the performance of ASP.NET applications, particularly when you have an increased number of clients. ASP.NET pages run side-by-side with ASP pages ASP.NET uses the.aspx file extension to allow ASP.NET pages to run sideby-side with existing ASP pages on Internet Information Services (IIS). The ASP.NET runtime will only process files with.aspx extensions;.asp files will be processed with the original ASP engine. You can easily migrate existing.asp files to.aspx files without making many changes to the code.

12 4 Module 7: Building Web Applications Automatic support for multiple browsers ASP.NET applications have the ability to render information differently to suit the capabilities of different browsers. You can create your application in the same way for both a simple browser that only supports HTML 3.2 and for an enhanced browser that supports dynamic HTML (DHTML), such as Microsoft Internet Explorer 4.0. You can even use Visual Basic.NET to create Web applications that will run on small devices such as Handheld PCs because of the ability of the ASP.NET Web server controls to render themselves appropriately for each client browser. ASP.NET namespaces provide rich functionality The ASP.NET framework provides several namespaces that allow you to use powerful built-in features, such as the ability to communicate between browser and server, to increase application performance by caching information, and to fully secure a Web site. The framework provides Web Service capabilities to allow access to your system services, and provides many predefined controls for use on Web Forms. Built-in support for Web Services ASP.NET includes built-in support for Web Services, enabling developers to build loosely coupled applications that use Simple Object Access Protocol (SOAP) for application-to-application communication.

13 Module 7: Building Web Applications 5 Using Response and Request Objects Topic Objective To explain how to use the Response and Request objects. Lead-in The Response and Request objects provide the ability to communicate between the server and the browser. The System.Web namespace provides common Web functionality Requesting information from the client Request object Dim Dim strvalue As As String String = Request.Form("txtInput") Sending information to the client Response object Response.Write("<H2>The date date is: is: " & Now.Date & "</H2>") *****************************ILLEGAL FOR NON-TRAINER USE****************************** You can use the System.Web namespace to access many of the classes that provide the base functionality of ASP.NET applications. Many of these classes are similar to those used by developers in ASP applications and have been enhanced in ASP.NET. You can use the Response and Request objects, provided by the System.Web namespace, to communicate between the client browser and the server computer. Both of these objects provide new properties and methods for their equivalent objects in ASP. Requesting Information from the Client Browser You can request information such as query string, cookie, and form values from a client browser by using the HttpRequest class. An instance of this class is available by means of the Request property of the current Web Form. The following example shows how to request the value currently stored in a text box on a Web Form: Dim strvalue As String = Request.Form("txtInput") Sending Information to the Client Browser You can send information such as cookie values, HTML output, and browser redirection to the client browser by using the HttpResponse class. An instance of this class is available by means of the Response property of the current Web Form. The following example uses the Response object to display the current date: Response.Write("<H2>The date is: " & Now.Date & "</H2>")

14 6 Module 7: Building Web Applications Maintaining Client-Side State Topic Objective To explain how to use the available client-side state facilities in the ASP.NET framework. Lead-in You can use several approaches to maintain client-side state in ASP.NET applications. Maintaining control state across multiple requests Set EnableViewState property of control Use the StateBag class to store extra data ViewState("TempData") ViewState("TempData") = Send data to client as hidden string <input <input type="hidden" type="hidden" name=" VIEWSTATE" name=" VIEWSTATE" value="do NnU=" value="do NnU=" /> /> Using cookies for enhanced client-side state Response.Cookies("User_FullName").Value Response.Cookies("User_FullName").Value = strfullname strfullname strfullname strfullname = Request.Cookies("User_FullName").Value Request.Cookies("User_FullName").Value *****************************ILLEGAL FOR NON-TRAINER USE****************************** Web pages are generally regarded as stateless devices, meaning that they do not remember any values between being displayed, destroyed, and displayed again. However, in ASP.NET you can choose to maintain state for a Web page when you need to. You can do this by using view state at the page and control level. Maintaining Control State Web pages are re-created each time a client browser makes a request. Normally this means that all control state is reset with each request. However, you can save the state of a page and its content by using the view state property or the StateBag class. Both approaches use a hidden variable to store the information as part of the page that is sent to the browser. This information is then retrieved when the page is posted back to the server. Using View State The System.Web.UI.Control class implements a property named EnableViewState. You can set this property to achieve the following functionality: True If you set this property to True (the default), any control that inherits from this base class will maintain its view state and the view state of any constituent control, through multiple requests by a single client browser. False If a page does not post back to itself, you can set this property to False to increase performance by reducing the size of the page.

15 Module 7: Building Web Applications 7 Using State Bags You can use the StateBag class to maintain additional cross-request information. An instance called ViewState is accessible from each Web Form and allows you to store and retrieve extra information. The following example shows how to create a stateful property (a value that is maintained for multiple requests) called TempData and assign a value of 25. You can then retrieve this data from the StateBag instance and display it to the user by using the Response.Write method. ViewState("TempData") = 25 Response.Write(ViewState("TempData")) When the page is sent to the browser, a hidden variable is included, as shown in the following example: <input type="hidden" name=" VIEWSTATE" value="do NnU=" /> Using Cookies for Enhanced Client-Side State A cookie is a simple mechanism for storing information in a text file on a client computer. You can use the HttpCookie class to provide a type-safe way to access cookies and manipulate cookie properties such as Expires, Value, and Name. Read and write access to a cookie is provided by means of the Cookies collection property for the Request and Response objects, respectively. The following example stores a cookie with an expiration date on the client computer before reading the data back from the client: Response.Cookies("User_FullName").Value = strfullname Response.Cookies("User_FullName").Expires = _ Now.AddMonths(1)... If Not (Request.Cookies("User_FullName") Is Nothing) Then strfullname = Request.Cookies("User_FullName").Value End If

16 8 Module 7: Building Web Applications Maintaining Server-Side State Topic Objective To explain how to use the server-side state facilities available in the ASP.NET framework. Lead-in You can use several approaches to maintain server-side state in ASP.NET applications. Application object maintains application-level state Data for use by all users Application("App_StartTime") = Now Now Session object maintains session-level state Data for use by a single client browser Data recoverable by means of Windows Service or SQL Server database Session("Session_StartTime") = Now Now *****************************ILLEGAL FOR NON-TRAINER USE****************************** Some parts of your Web application may need to maintain cross-request state. For example, a shopping cart application may need to maintain information about a customer order through multiple visits to a page before the items are purchased. You can maintain state at either the application or session level. Delivery Tip Ensure that students understand the concepts of a Web farm and Web garden. Maintaining Application State You can use the HttpApplicationState class to store application-level information. You can use the intrinsic Application object during a Web request to share global data across the application. The default Item property of this object stores and retrieves a collection of objects, allowing anything from a string to a user-defined object to be maintained for the lifespan of the application. Application state is not shared across a Web farm or a Web garden. Note A Web farm is an application that is hosted across multiple computers. A Web garden is an application that is hosted on a single computer with multiple processors. Example The following example shows how to store the start time of the application and then displays the information at a later stage: Application("App_StartTime") = Now... Response.Write("Application Started: " & _ Application("App_StartTime"))

17 Module 7: Building Web Applications 9 About Application State Note the following information when using application state: The Contents collection property of the HttpApplicationState class provides backward compatibility with ASP. Multiple-user sessions within an ASP.NET application can potentially modify data, resulting in values that differ from those expected by a single user. The following example shows how you can use the Lock and Unlock methods to avoid this problem: Application.Lock Application("aCounter") = Application("aCounter") + 1 Application.Unlock Maintaining Session State The server maintains session state information for each browser client as a logical session until the session ends. The session ends when a time out occurs or when the user moves away from the ASP.NET application. Example You can use the intrinsic Session object to access this state information. The following example shows how to use session state to store a start time that can be retrieved at a later stage during the user s session: Session("Session_StartTime") = Now... Response.Write("Session started: " & _ Session("Session_StartTime")) About Session State Note the following facts and guidelines when using session state in ASP.NET applications: ASP.NET session state maintains backward compatibility with ASP session state. You can store session state in three ways: As part of the application process As an external Microsoft Windows Service, allowing for ASP.NET application restarts and data sharing across multiple processors (Web gardens) As data in a Microsoft SQL Server database, allowing the session data to be available across multiple computers (Web farms) While ASP applications require a cookie to store a unique SessionID value that links a user to a particular session, ASP.NET does not require cookies in order to store session state. In the Web.config file, you can choose the option to automatically encode the SessionID value in the Uniform Resource Locator (URL). This means that all browsers can use session information even if the user has disabled cookie support. Note For more information about configuring session state, search for web.config in the Microsoft Visual Studio.NET documentation.

18 10 Module 7: Building Web Applications Managing an ASP.NET Application Topic Objective To discuss the way ASP.NET applications are managed. Lead-in Managing ASP.NET applications is straightforward. Configuring ASP.NET applications XML configuration file Web.config Human-readable and writeable Stored with the application Deploying ASP.NET applications XCOPY the pages, components, and configuration No registration required Updating ASP.NET applications Copy new files over old files No update utility, restart, or reboot required Live update keeps applications running *****************************ILLEGAL FOR NON-TRAINER USE****************************** ASP.NET applications are simple to configure, deploy, and maintain. Delivery Tip Deployment is covered in more depth in Module 10, Deploying Applications, in Course 2373B, Programming with Microsoft Visual Basic.NET. Configuring ASP.NET Applications An ASP.NET application can contain web.config configuration files. These files store information about the application, including application settings, custom browser capabilities, custom errors, security, and more. The document format is Extensible Markup Language (XML), so you can use any text or XML editor to read or edit the file. You deploy the configuration file to the same virtual directory as the application it configures. The file also configures any applications in subdirectories of that virtual directory, unless those applications have their own configuration file. Note For more information about configuring ASP.NET applications, search for ASP.NET configuration in the Visual Studio.NET documentation.

19 Module 7: Building Web Applications 11 Deploying ASP.NET Applications You deploy an ASP.NET application by copying the required files to a virtual directory on an IIS computer. No component registration is required because the components contain their own self-describing metadata. This also solves registry problems previously associated with deploying components. Note For more information about deployment of Visual Basic.NET-based applications, see Module 10, Deploying Applications, in Course 2373B, Programming with Microsoft Visual Basic.NET. Updating ASP.NET Applications You can update an ASP.NET application at any time without needing to restart the application or IIS, because no components are locked at any stage. No update utility is required because you can simply copy new files over the old ones. The ASP.NET framework detects the update, and it upgrades the live application.

20 12 Module 7: Building Web Applications Overview of ASP.NET Security Topic Objective To provide an overview of security in ASP.NET applications. Lead-in ASP.NET applications can be secured in various ways. Security settings stored in web.config file Out-of-box authentication support Windows authentication Basic, Digest, or Integrated Microsoft Passport authentication Forms (Cookie) authentication Role-based security architecture *****************************ILLEGAL FOR NON-TRAINER USE****************************** Delivery Tip Security is a complicated topic and is only briefly covered in this lesson. Direct students to additional material as often as possible. Most companies need to secure their Web applications so that users can only perform actions they are authorized to perform. The required levels of security can include simple public access to Web pages, secure validation of credit card information, and secure access for trading partners. The System.Web.Security namespace provides all aspects of ASP.NET security. Security Settings Stored in web.config File You can specify security settings in the web.config configuration file that is then deployed with the application. This allows you to define which security options your applications use and, optionally, which users can use the system. Out-of-Box Authentication Support ASP.NET works closely with IIS 5.0 to accept and validate user credentials by using the following authentication methods. Windows authentication. Windows authentication does not require any specific coding in your ASP.NET application, but it does require extra administration when the application is deployed. IIS provides three ways to perform Windows authentication: Basic, Digest, and Integrated. Authentication Definition Basic Digest Integrated Before information without encryption is posted to IIS, a Windows dialog box appears in which users enter their user name and password. Performs the same action as Basic authentication; however, the information is encrypted when sent to the server. Uses the user s logged-on Windows domain account details. This option is more suitable for an intranet application than for an Internet application because it cannot be used through firewalls or proxy servers.

21 Module 7: Building Web Applications 13 The following example shows how to specify Windows authentication in the Web.config file: <authentication mode="windows" /> Note For more information about the different types of authentication, see Designing Secure Web-Based Applications for Microsoft Windows 2000, by Michael Howard, Microsoft Press. Microsoft Passport authentication. Passport authentication requires the user to have a Microsoft Passport that can be created on the Internet. This approach benefits users because they use the same sign-in name and password for any Web site that uses this type of authentication. Note For more information about passports, go to Forms (Cookie) authentication. Web sites that require users to logon to the system from an HTML form usually store a cookie on the client computer. The cookie is used for subsequent visits to the site and the information can then be used for whatever purpose the site requires. This type of authentication is ideal for querying user details against a database in an e-commerce situation. Role-Based Security Architecture ASP.NET allows you to selectively allow or deny requests from specific users or groups of users known as roles. You can store the list of users and roles as part of the Web.config file or as a separate XML document. The following example shows code to use in the Web.config file to allow access for two particular users and the Admins role but deny access to all others using Windows authentication: <authentication mode="windows" /> <authorization> <allow users="doug,denise" /> <deny users="*" /> <allow roles="admins" /> <deny roles="*" /> </authorization> Note For more information about role-based security, see ASP.NET Authorization in the Visual Studio.NET documentation.

22 14 Module 7: Building Web Applications Using Global Events with Global.asax Topic Objective To describe the uses of the Global.asax file in an ASP.NET application. Lead-in The Global.asax file provides application-level logic to your ASP.NET application. Useful for initializing data for application or session state Sub Sub Application_Start(ByVal Application_Start(ByVal Sender Sender As As Object, Object, ByVal ByVal e As As EventArgs) EventArgs) Application("SessionCounter") = 0 End End Sub Sub Sub Sub Session_Start(ByVal Session_Start(ByVal Sender Sender As As Object, Object, ByVal ByVal e As As EventArgs) EventArgs) Application("SessionCounter") Application("SessionCounter") = Application("SessionCounter") Application("SessionCounter") + 1 Session("StartTime") Session("StartTime") = Now Now End End Sub Sub Sub Sub Session_End(ByVal Session_End(ByVal Sender Sender As As Object, Object, ByVal ByVal e As As EventArgs) EventArgs) Application("SessionCounter") Application("SessionCounter") = Application("SessionCounter") Application("SessionCounter") - 1 End End Sub Sub *****************************ILLEGAL FOR NON-TRAINER USE****************************** You can initialize state for application-level or session-level data by using the Global.asax application file. This application file enhances the Global.asa application file used in ASP. Avoid using local variables to store information, because ASP.NET may create multiple instances of the global class. If you need to store information, use application-state or session-state. Application-Level Events ASP.NET provides several events to initialize state at the application level, including the following: Application_Start This event is activated when the first user attempts to gain access to access your Web application. Any subsequent requests will not activate this event even if multiple instances of the Global class have been instantiated. This event is particularly useful for initializing application-state information. Application_BeginRequest This event is activated whenever a request for a URL is received from a client application. Application_EndRequest This event is activated whenever a request for a URL has been completed. Application_End This event is activated when the last instance of the Global class is destroyed so that any final resources can be cleaned up.

23 Module 7: Building Web Applications 15 Session-Level Events ASP.NET also provides session-level events, including the following: Session_Start This event is activated at the beginning of a new client session and is useful for initializing session-state information. Session_End This event is activated when a client session ends after a period of inactivity or if the Session.Abandon method is explicitly called as part of your application code. Example The following example shows how you could use these events in conjunction with state management objects to initialize stateful data: Sub Application_Start(ByVal sender As Object, _ ByVal e As EventArgs) 'Initialize the application-level counter Application("SessionCounter") = 0 End Sub Sub Session_Start(ByVal sender As Object, _ ByVal e As EventArgs) 'Increment the application-level counter Application("SessionCounter") = _ Application("SessionCounter") + 1 'Assign new value to session-level data Session("StartTime") = Now End Sub Sub Session_End(ByVal sender As Object, ByVal e As EventArgs) 'Decrement the application-level counter Application("SessionCounter") = _ Application("SessionCounter") - 1 End Sub

24 16 Module 7: Building Web Applications Creating Web Form Applications Topic Objective To provide an overview of the topics covered in this lesson. Lead-in Web Forms create the visual interaction between the server computer and the user in the same way that HTML and script did previously, but in a compiled and more maintainable fashion. Structure of Web Forms Using HTML Controls Advantages of Web Server Controls Using Web Server Controls Handling Events *****************************ILLEGAL FOR NON-TRAINER USE****************************** Traditionally, you create Web applications by using a combination of static HTML pages and dynamic content provided by client-side and server-side script. ASP.NET provides Web Forms to improve and enhance Web applications. After you complete this lesson, you will be able to: Describe the files that constitute a Web Form. Use the different types of controls available on a Web Form, including HTML and Web server controls. Write code in event handlers that will execute on the server.

25 Module 7: Building Web Applications 17 Structure of Web Forms Topic Objective To describe the structure of ASP.NET Web Forms. Lead-in Because ASP pages often contain script mixed with HTML tags, they can be difficult to maintain. ASP.NET solves this issue by separating the HTML tags from the page logic. Web Forms separate declarative tags from logic The.aspx file contains HTML and other tags The code-behind file contains logic and event handling <tags> code Logon.aspx Logon.aspx.vb *****************************ILLEGAL FOR NON-TRAINER USE****************************** Delivery Tip Point out that, when the application is built and deployed, the.aspx files are copied, but the.aspx.vb files are compiled into the appropriate DLL file. Alternatively, developers can include both code and HTML tags within a single.aspx file by using the <script> tag. This approach provides less separation between the code and tags, but does not require a DLL file to be built and deployed with the application. Because ASP pages often contain HTML tags mixed with user interface eventhandling script, they can be difficult to maintain. When developing applications with the Visual Studio.NET Integrated Development Environment (IDE), ASP.NET Web Forms consist of two separate files: the.aspx file for HTML and other tags, and the code-behind file for the code that executes as a result of user interaction. Because the tags and the code are separated in ASP.NET, you can more easily locate bugs and maintain code. The.aspx File The.aspx file contains definitions for the visual elements of the Web Form, such as the HTML tags, Web controls, client-side script, and static text. This file also includes any ASP.NET directives, such as links to the code-behind module that contains the logic and event-handling code of the Web Form. You can use the Web Forms Designer in Design view to create a page by using drag-and-drop techniques. You can use the HTML view to edit the HTML tags. Microsoft IntelliSense is provided in this view to increase the efficiency and accuracy of creating HTML tag expressions.

26 18 Module 7: Building Web Applications The Code-Behind File The code-behind file is a file with an.aspx.vb extension in an ASP.NET project using Visual Basic.NET. Your server-side and event-handling code is automatically placed in the code-behind file of a Web Form. This file defines a class that is referenced by Page directive within the.aspx file of the Web Form. You can use this class to: Create methods or event-handling code. Provide access to many of the commonly used ASP.NET objects. This class inherits from the System.Web.UI.Page class to provide direct access to many ASP.NET objects, such as Request and Response. Provide event handlers. The class provides a series of useful event handlers, such as the page Load, Init, Unload, and PreRender events. The code generated in the code-behind file looks very similar to the code generated in Windows Forms. Note the following when using the code-behind file: It contains variable declarations. The code contains variable declarations for the visible controls so they can be accessed programmatically within your procedures. It contains variable events. As the control variables are declared using the WithEvents modifier, you can use the control events to execute user interface code to handle events like submitting information to a database or linking to another page. It automatically compiles with your application. The code in this file is automatically compiled into your dynamic-link library (DLL) when you build the application.

27 Module 7: Building Web Applications 19 Using HTML Controls Topic Objective To explain how to use HTML controls. Lead-in ASP.NET provides two main types of controls for you to use: HTML controls and Web controls. Direct relationship to preexisting HTML tags Client side by default Server side with runat=server directive Properties correspond one-to-one with HTML, weakly typed Defined with HTML tag <input <input type=text id="text1" value="some text" text" runat="server"> ASP.NET includes HTML controls for commonly used HTML elements *****************************ILLEGAL FOR NON-TRAINER USE****************************** HTML controls have a direct relationship to preexisting HTML tags. The controls are defined by classes in the System.Web.UI.HtmlControls namespace supplied by the.net Framework. These controls correspond very closely to the HTML elements that they render. Specifying Client-Side or Server-Side HTML Controls By default, HTML controls are run on the client. They are treated as opaque text by the server and passed straight through to the browser for interpreting as HTML elements. You can also write client-side script to process control events on the client. To run controls on the server, set the runat directive to the value of server to convert the HTML elements to HTML server controls. You can do this manually by editing the HTML tag of the control, or you can select the option on the context menu of the control. Manipulating HTML Controls You define all HTML by using an HTML tag. For example, the following code declares a text input field to run on the server: <input type=text id="text1" value="some text" runat="server"> You can manipulate control properties programmatically from server-side code when the control is marked to run on the server. These properties correspond directly to their equivalent HTML tag predecessors. For example, the HTML tag <INPUT> supports an attribute called Value, and the HTMLInputText class supports an equivalent Value property.

28 20 Module 7: Building Web Applications You can set other properties of the HTML control by using the Attributes collection property of the control. This type of property setting is considered weakly typed because the collection only stores and retrieves String values, as shown in the following example: HTMLTable1.Attributes("bgColor") = "Green" 'Weakly typed To specify the programmatic accessor that identifies the control in the server code, use the ID attribute. To set the initial display value of the text field, use the VALUE attribute. HTML Elements and HTML Server Controls ASP.NET includes HTML controls for commonly used HTML elements such as forms, input elements, tables, and so on. The following list matches the client-side HTML elements with their corresponding HTML server controls. HTML element HTML server control <A> HTMLAnchor <IMG> HTMLImage <FORM> HTMLForm <TABLE> HTMLTable <TR> HTMLTableRow <TD> HTMLTableCell <SELECT> HTMLSelect <TEXTAREA> HTMLTextArea <BUTTON> HTMLButton <INPUT TYPE=TEXT> HTMLInputText < INPUT TYPE=FILE> HTMLInputFile < INPUT TYPE=SUBMIT> HTMLInputButton < INPUT TYPE=BUTTON> HTMLInputButton < INPUT TYPE=RESET> HTMLInputButton < INPUT TYPE=HIDDEN> HTMLInputHidden

29 Module 7: Building Web Applications 21 Advantages of Web Server Controls Topic Objective To provide an overview of the features of Web server controls. Lead-in The second type of control that ASP.NET includes is the Web server control. Automatic browser detection Detect capabilities of client and render accordingly Strongly typed, consistent object model Enables compile-time type checking Declared with XML tags Server side only using runat=server directive <asp:textbox id="text2" text="some text" text" runat="server"> </asp:textbox> Rich functionality Example: Calendar or RadioButtonList control *****************************ILLEGAL FOR NON-TRAINER USE****************************** In addition to HTML controls, ASP.NET Web Forms also provide Web server controls. Web server controls run exclusively on the server, and provide the following advantages: Automatic browser detection Web server controls can render themselves differently to suit the capabilities of different browsers. For example, a control may send dynamic HTML (DHTML) to a rich browser (HTML 4.0 and later), and send HTML and script to a more basic client browser. This is known as creating uplevel and downlevel capability. Strongly typed, consistent object model Web server controls are strongly typed, so compile-time checking of code provides you with accurate error messages before the application is built. With Web controls, you can use a consistent object model, which is similar to Windows Forms controls. For example, you can set the BackColor property of a Button control explicitly by using a strongly typed constant, as shown in the following example. Button.BackColor = Color.Green 'Strongly typed

30 22 Module 7: Building Web Applications Declared with XML tags You declare Web server controls by using an XML tag. This tag references the asp namespace and specifies information regarding the type of Web control, a programmatic identifier through use of the ID attribute, and any initial values. The following example shows the syntax for creating a simple TextBox Web control whose ID is text2 and whose initial TEXT value is some text. <asp:textbox id="text2" text="some text" runat="server"> </asp:textbox> Rich functionality Web server controls include enhanced versions of traditional HTML form controls such as Button and TextBox, as well as complex controls such as Calendar, DataGrid, and AdRotator (advertisement rotator). These controls do not correspond directly to HTML elements or attributes.

31 Module 7: Building Web Applications 23 Using Web Server Controls Topic Objective To explain available Web server controls. Lead-in There are several types of Web server controls available in ASP.NET Web Forms. Intrinsic controls List controls for repetition Validation controls validate input Rich controls simplify common Web page requirements *****************************ILLEGAL FOR NON-TRAINER USE****************************** Delivery Tip Pick one or two individual controls for discussion, particularly a validation control and rich control. ASP.NET Web server controls can be separated into four main categories: intrinsic, list, validation, and rich controls. The table below explains each of these categories. Category Definition Examples Intrinsic controls List controls Validation controls Rich controls Provides the basic functionality for user interaction with the browser. Many of these controls are similar to the corresponding HTML controls, but their enhanced properties and methods allow a more powerful and consistent programming style. Used for repetition when displaying any type of list. Provides simple control validation that displays a message to the user without making a return trip to the server. Simplifies common Web page requirements. Button, TextBox, CheckBox DropDownList, ListBox, Repeater, DataGrid RequiredFieldValidator, RangeValidator, RegularExpressionValida tor, CompareValidator AdRotator, Calendar