Asp.NET Session Management

In Asp.net, there are 4 methods available for session management.

1. InProc
   This is the default mode used in ASP.net. Session state will be stored on same ASP.net
   process and perform best. If IIS restarts session state will lost.
   Use when, Session data is not critical and Web application hosted in a single server.
   


2. StateServer
   This is, Windows NT service called ASPState, used to store session state out of ASP.net process.
   
   
   To enable this , Start the service, run command
   net start aspnet_state 
   In the web.config add or change following element
   
   

   <configuration>
       <system.web>
           <sessionState mode="StateServer"
               stateConnectionString="tcpip=servername:portno"
               cookieless="false"
               timeout="20"/>
       </system.web>
   </configuration>

   
   By default stateConnectionString is 127.0.0.1:42424
   


3. SqlServer
   Session state will store in SQL server so that higher level of reliability. This is best for clustered/web farm environment although performance isn’t as fast as former 2 modes.
   You have to do,
   On the computer SQL server running, run InstallSqlState.sql
   to create necessary tables and sps to manage session state. This file can be found,by default, %SystemRoot%\Microsoft.NET\Framework\v2.x.xxxx\
   Note: for .net 3.5 you have to find this file from .net 2.0 path.
   
   In web.config,
   

   <sessionState
      mode="SQLServer"
      sqlConnectionString="Integrated Security=SSPI;data source=sqlserver;"
      sqlCommandTimeout="10" />
     </system.web>
   </configuration>
   

   
   You don’t have to explicitly put Initial Catalog for sqlConnectionString attribute.
   


4. Custom
   This mode is very rarely used unless you want to store session state on custom data store. To implement custom mode you can find more information on MSDN.
   

Silverlight Competition

Kaspersky Web Site Hacked With SQL Injection

The hacker, known as Unu, hacked Kaspersky web site on Feb. 7, 2009  via a simple SQL injection attack. more ...

As I know that site was built using php & mysql.

In ASP.Net, such SQL injection attack can avoid if we follow standard guidelines. As a developer keep followings in mind.

1. Always, don’t believe in what user has input.
2. If executes SQL command from a page, don’t use concatenated SQL commands. Always use respective DbParameter class to build a command string.
   Following example using  SQLParamerter.
   Incorrect
   “SELECT cusid,cusname  FROM customer WHERE cusid= “ + userinput “
   Correct
   “SELECT cusid,cusname  FROM customer WHERE cusid= @userinput “
   
3. In the production version of your web application, turn off tracing and avoid <customErrors mode="Off"/> setting in web.config.
   
4. Don’t give error messages that intruder can guess information about your database.
   

Can XBAP run under full-trust mode

A WPF Application can developed to run as standalone or browser based application(XBAP).

In XBAP version there are limitations, like accessing network, SQL operation, file IO operations etc. Because XBAP, by default, run under Partial Trust mode.

You can switch on XBAP to a Full Trust mode anyway. But there are some limitations in terms of deployment.

Full trust XBAP application will only run in local machine as we expected. Even if we set XBAP as Full Trust, it will failed to load in intranet or Internet zone.

Figure 1: When deploy under full trust mode on remote location.

To run under full trust, we want to do one of the followings,

1. Install XBAP to the local machine (deploy as .msi file).


2. Sign the XBAP using a trust certificate and install that certificate to the client machine using cermgr.exe


3. Authorise application URI to be trusted using caspol.exe or .NET 2.0 configuration wizard.
   

First one is very straightforward but, all things have to done at each client machine. If you really want to enable full trust, develop as WPF standalone application.

Movex Class Builder

For my current projects @ Brandix Lanka, we want to create couple of interfaces for Movex ERP. In Movex, functionalities exposes in a way of API.

My duty is create C# classes for particular API, to data retrieval or update. We have already created a wrapper class for Movex connection.

I created MS-Visual Studio Add-in to generates C# classes for particular API.



Features:

1. you can browse Movex API details.
2. Generates C# class to the current project and organised by API automatically.
   
3. Integrated to the VS IDE
4. Currently supports for VS2005 and VS2008

Why AJAX Update Panel Causing Errors?

AJAX update panel, throw an error if we use methods such as Response.Write(), Server.Transfer() etc. But it's works fine with Response.Redirect() method.

This is really happen to me. As my knowledge I suppose, because Update Panel process response proportionally or fetch only changes to the current response, instead of whole response. That's why we cant see the whole page get refreshed even if a post back occurs.

In my web application, when user click on print button it should bring up a new pop-up window with the preview. Since this button is inside the UpdatePanel it throws an exception.

protected void OnPrintClick(object sender, EventAgrs e)
{
Response.Write("<script type=\"text/javascript\">window.open(\"reports.aspx\",\"\",\"toolbar=0,
menubar=0,resizable=yes\");</script>");
}

When run this line, I got following error.

I change above code as follows,

protected void OnPrintClick(object sender, EventAgrs e)
{
StringBuilder _sb = new StringBuilder();
_sb.Append("window.open('reports.aspx','',");
_sb.Append("'toolbar=0,menubar=0,resizable=yes')");
// Register java script to the ScriptManager.
ScriptManager.RegisterStartupScript(Page, Page.GetType(),
"winOpen", _sb.ToString(), true);
}

It works now as I expected.

For Career

Read this before you make a decision
(Courtesy: Yahoo! Inc.)