Pro ASP.NET MVC 2 Framework

Title page

Copyright page

Contents at a Glance

Table of contents

About the Author

About the Technical Reviewers

Acknowledgments

Introduction

You Don’t Need to Know ASP.NET MVC 1 Already

Which Technologies Are Used in This Book

Code Samples

Errata

Contacting the Author

PART 1 Introducing ASP.NETMVC 2

CHAPTER 1 What’s the Big Idea?

A Brief History of Web Development

Traditional ASP.NET Web Forms

What’s Wrong with ASP.NET Web Forms?

Web Development Today

Web Standards and REST

Agile and Test-Driven Development

Ruby on Rails

Key Benefits of ASP.NET MVC

MVC Architecture

Extensibility

Tight Control over HTML and HTTP

Testability

Powerful Routing System

Built on the Best Parts of the ASP.NET Platform

Modern API

ASP.NET MVC Is Open Source

Who Should Use ASP.NET MVC?

Comparisons with ASP.NET Web Forms

Migrating from Web Forms to MVC

Comparisons with Ruby on Rails

Comparisons with MonoRail

What’s New in ASP.NET MVC 2

Summary

CHAPTER 2 Your First ASP.NET MVCApplication

Preparing Your Workstation

Creating a New ASP.NET MVC Project

Adding the First Controller

Rendering Web Pages

Creating and Rendering a View

Adding Dynamic Output

A Starter Application

The Story

Designing a Data Model

Adding a Model Class

Linking Between Actions

Introducing Strongly Typed Views

Building a Form

Dude, Where’s My Data?

Handling Form Submissions

Introducing Model Binding

Rendering Arbitrary Views and Passing a Model Object to Them

Adding Validation

Model Binding Tells Input Controls to Redisplay User-Entered Values

Highlighting Invalid Fields

Finishing Off

Summary

CHAPTER 3 Prerequisites

Understanding MVC Architecture

The Smart UI (Anti-Pattern)

Separating Out the Domain Model

Model-View Architecture

Three-Tier Architecture

MVC Architecture

Implementation in ASP.NET MVC

History and Benefits

Variations on MVC

Where’s the Data Access Code?

Putting Domain Logic Directly into Controllers

Model-View-Presenter

Model-View-View Model

Domain Modeling

An Example Domain Model

Ubiquitous Language

Aggregates and Simplification

Is It Worth Defining Aggregates?

Keeping Data Access Code in Repositories

Using LINQ to SQL

Implementing the Auctions Domain Model

Implementing the Auction Repositories

Building Loosely Coupled Components

Taking a Balanced Approach

Using Dependency Injection

An MVC-Specific Example

Using a DI Container

Meet Ninject

Getting Started with Automated Testing

Understanding Unit Testing

How DI Supports Unit Testing

TDD and the Red-Green-Refactor Workflow

To Unit Test or Not to Unit Test

Understanding Integration Testing

BDD and the Given-When-Then Model

Why This Book Demonstrates Unit Testing Rather Than Integration Testing

C# 3 Language Features

The Design Goal: Language-Integrated Query

Extension Methods

Lambda Methods

Generic Type Inference

Automatic Properties

Object and Collection Initializers

Type Inference

Anonymous Types

Putting It All Together

Deferred Execution

Using LINQ to Objects

Lambda Expressions

IQueryable and LINQ to SQL

LINQ to Everything

Summary

CHAPTER 4 SportsStore: A Real Application

Getting Started

Creating Your Solutions and Projects

Starting Your Domain Model

Creating an Abstract Repository

Making a Fake Repository

Displaying a List of Products

Adding the First Controller

Setting Up the Default Route

Adding the First View

Connecting to a Database

Defining the Database Schema

Setting Up LINQ to SQL

Creating a Real Repository

Setting Up DI

Creating a Custom Controller Factory

Using Your DI Container

Creating Unit Tests

Configuring a Custom URL Schema

Assigning a Default Parameter Value

Displaying Page Links

Making the HTML Helper Method Visible to All View Pages

Supplying a Page Number to the View

Improving the URLs

Styling It Up

Defining Page Layout in the Master Page

Adding CSS Rules

Creating a Partial View

Summary

CHAPTER 5 SportsStore: Navigation andShopping Cart

Adding Navigation Controls

Filtering the Product List

Implementing the Category Filter

Defining a URL Schema for Categories

Building a Category Navigation Menu

Creating the Navigation Controller

Selecting and Rendering a List of Category Links

Highlighting the Current Category

Building the Shopping Cart

Defining the Cart Entity

Adding “Add to Cart” Buttons

Multiple

Tags

Giving Each Visitor a Separate Shopping Cart

ASP.NET MVC Offers a Tidier Way of Working with Session Storage

Creating a Custom Model Binder

Creating CartController

Implementing AddToCart and RemoveFromCart

Displaying the Cart

Removing Items from the Cart

Displaying a Cart Summary in the Title Bar

Submitting Orders

Enhancing the Domain Model

Adding the “Check Out Now” Button

Prompting the Customer for Shipping Details

Defining an Order Submitter DI Component

Completing CartController

Adding a Fake Order Submitter

Displaying Validation Errors

Displaying a “Thanks for Your Order” Screen

Implementing EmailOrderSubmitter

Summary

CHAPTER 6 SportsStore: Administration andFinal Enhancements

Adding Catalog Management

Creating AdminController: A Place for the CRUD Features

Rendering a Grid of Products in the Repository

Implementing the List View

Building a Product Editor

Creating a Product Editor UI

Handling Edit Submissions

Adding Validation

Enabling Client-Side Validation

Creating New Products

Deleting Products

Securing the Administration Features

Setting Up Forms Authentication

Using a Filter to Enforce Authentication

Displaying a Login Prompt

Image Uploads

Preparing the Domain Model and Database

Accepting File Uploads

A Little-Known Fact About HTML Forms

Saving the Uploaded Image to the Database

Handling Form Posts That Don’t Include an Image

Displaying Product Images

Summary

PART 2 ASP.NET MVC in Detail

CHAPTER 7 Overview of ASP.NET MVC Projects

Developing MVC Applications in Visual Studio

Naming Conventions

The Initial Application Skeleton

Debugging MVC Applications and Unit Tests

Launching the Visual Studio Debugger

Attaching the Debugger to IIS

Attaching the Debugger to a Test Runner (e.g., NUnit GUI)

Remote Debugging

Using the Debugger

Stepping into the .NET Framework Source Code

Stepping into the ASP.NET MVC Framework Source Code

The Request Processing Pipeline

Stage 1: IIS

Stage 2: Core Routing

Routing Configurations

Stage 3: Controllers and Actions

Finding and Invoking Controllers

What Controllers Must Do

What Controllers Normally Do

Stage 4: Action Results and Views

Rendering a View

Summary

CHAPTER 8 URLs and Routing

Putting the Programmer Back in Control

About Routing and Its .NET Assemblies

Setting Up Routes

Understanding the Routing Mechanism

The Main Characters: RouteBase, Route, and RouteCollection

How Routing Fits into the Request Processing Pipeline

The Order of Your Route Entries Is Important

Adding a Route Entry

URL Patterns Match the Path Portion of a URL

Meet RouteValueDictionary

Take a Shortcut with MapRoute()

Using Parameters

Receiving Parameter Values in Action Methods

Using Defaults

Creating Optional Parameters with No Default Value

Using Constraints

Matching Against Regular Expressions

Matching HTTP Methods

Matching Custom Constraints

Prioritizing Controllers by Namespace

Accepting a Variable-Length List of Parameters

Matching Files on the Server’s Hard Disk

Using the RouteExistingFiles Flag

Using IgnoreRoute to Bypass the Routing System

Generating Outgoing URLs

Generating Hyperlinks with Html.ActionLink()

Passing Extra Parameters

How Parameter Defaults Are Handled

Generating Fully Qualified Absolute URLs

Generating Links and URLs from Pure Routing Data

Performing Redirections to Generated URLs

Understanding the Outbound URL-Matching Algorithm

Generating Hyperlinks with Html.ActionLink and Lambda Expressions

Working with Named Routes

Why You Might Not Want to Use Named Routes

Working with Areas

Setting Up Areas

Routing and URL Generation with Areas

Linking to an Action in the Same Area

Linking to an Action in a Different Area

Linking to an Action in the Root Area

Areas and Explicitly Named Routes

Areas and the Ambiguous Controller Problem

Areas Summary

Unit Testing Your Routes

Testing Inbound URL Routing

Using Test Doubles

Using a Mocking Framework (Moq)

Testing Outbound URL Generation

Unit Testing Area Routes

Further Customization

Implementing a Custom RouteBase Entry

Implementing a Custom Route Handler

URL Schema Best Practices

Make Your URLs Clean and Human-Friendly

Follow HTTP Conventions

GET and POST: Pick the Right One

On Query Strings

Use the Correct Type of HTTP Redirection

SEO

Summary

CHAPTER 9 Controllers and Actions

An Overview

Comparisons with ASP.NET Web Forms

All Controllers Implement IController

The Controller Base Class

Receiving Input

Getting Data from Context Objects

Using Action Method Parameters

Parameters Objects Are Instantiated Using Value Providers and Model Binders

Optional and Compulsory Parameters

Specifying Default Parameter Values

Parameters You Can’t Bind To

Invoking Model Binding Manually in an Action Method

Producing Output

Understanding the ActionResult Concept

Returning HTML by Rendering a View

Rendering a View by Path

Passing a ViewData Dictionary and a Model Object

Treating ViewData As a Loosely Typed Dictionary

Sending a Strongly Typed Object in ViewData.Model

Combining Both Approaches

Passing a Dynamic Object As ViewData.Model

Performing Redirections

Redirecting to a Different Action Method

Redirecting to a Different URL

Using TempData to Preserve Data Across a Redirection

Where TempData Stores Its Data

Controlling the Lifetime of TempData Items

Returning Textual Data

Generating an RSS Feed

Returning JSON Data

Returning JavaScript Commands

Returning Files and Binary Data

Sending a File Directly from Disk

Sending the Contents of a Byte Array

Sending the Contents of a Stream

Creating a Custom Action Result Type

Example: Watermarking an Image (and the Concept of Unit Testability Seams)

Unit Testing Controllers and Actions

How to Arrange, Act, and Assert

Testing a Choice of View and ViewData

Testing ViewData Values

Testing Redirections

More Comments About Unit Testing

Mocking Context Objects

Reducing the Pain of Mocking

Method 1: Make a Reusable Helper That Sets Up a Standard Mock Context

Method 2: Access Dependencies Through Virtual Properties

Method 3: Receive Dependencies Using Model Binding

Method 4: Turn Your Dependencies into DI Components

Method 5: Factor Out Complexity and Don’t Unit Test Controllers

Summary

CHAPTER 10 Controller Extensibility

Using Filters to Attach Reusable Behaviors

Introducing the Four Basic Types of Filter

Applying Filters to Controllers and Action Methods

Creating Action Filters and Result Filters

Controlling the Order of Execution

Filters on Actions Can Override Filters on Controllers

Using the Controller Itself As a Filter

Creating and Using Authorization Filters

How Authorization Filters Interact with Output Caching

Creating a Custom Authorization Filter

Creating and Using Exception Filters

Using HandleErrorAttribute

Creating a Custom Exception Filter

Bubbling Exceptions Through Action and Result Filters

The [OutputCache] Action Filter

The [RequireHttps] Filter

Other Built-In Filter Types

Controllers As Part of the Request Processing Pipeline

Working with Default Controller Factory

Prioritizing Namespaces Globally Using DefaultNamespaces

Prioritizing Namespaces on Individual Route Entries

Limiting a Route Entry to Match Controllers in a Specific Set of Namespaces

Creating a Custom Controller Factory

Registering a Custom Controller Factory

Customizing How Action Methods Are Selected and Invoked

The Real Definition of an Action

Using [ActionName] to Specify a Custom Action Name

Method Selection: Controlling Whether a C# Method Should Agree to Handle a Request

Creating a Custom Action Method Selector Attribute

Using the [NonAction] Attribute

How the Whole Method Selection Process Fits Together

Handling Unknown Actions

Overriding HTTP Methods to Support REST Web Services

Submitting a Plain HTML Form with an Overridden HTTP Method

How HTTP Method Overriding Works

Boosting Server Capacity with Asynchronous Controllers

Introducing Asynchronous Requests

Using Asynchronous Controllers

Turning a Synchronous Action into an Asynchronous Action

Passing Parameters to the Completion Method

Controlling and Handling Timeouts

Using Finish() to Abort All Remaining Asynchronous Operations

Using Sync() to Transition Back to the Original HTTP Context

Adding Asynchronous Methods to Domain Classes

Choosing When to Use Asynchronous Controllers

Measuring the Effects of Asynchronous Controllers

Ensuring Your Server Is Configured to Benefit from Asynchronous Requests

Summary

CHAPTER 11 Views

How Views Fit into ASP.NET MVC

The Web Forms View Engine

View Engines Are Replaceable

Web Forms View Engine Basics

Adding Content to a View

Five Ways to Add Dynamic Content to a View

Using Inline Code

Why Inline Code Is a Good Thing in MVC Views

Understanding How MVC Views Actually Work

Understanding How ASPX Pages Are Compiled

The Code-Behind Model

How Automatic HTML Encoding Works

How ASP.NET 4 Automatically Skips Encoding When Rendering HTML Helpers

Introducing the <%: ... %> Syntax

Working with MvcHtmlString

Using Custom Encoding Logic (Applies to .NET 4 Only)

Understanding ViewData

Extracting ViewData Items Using ViewData.Eval

Using HTML Helper Methods

The Framework’s Built-In Helper Methods

Rendering Input Controls

Using Strongly Typed Input Controls

How Input Controls Get Their Values

Adding Arbitrary Tag Attributes

A Note About HTML Encoding

Rendering Links and URLs

Performing HTML and HTML Attribute Encoding

Rendering Drop-Down and Multiselect Lists

Bonus Helper Methods in Microsoft.Web.Mvc.dll

Other HTML Helpers

Rendering Form Tags

Forms That Post Back to the Same URL

Using Html.BeginForm

Creating Your Own HTML Helper Methods

Using Partial Views

Creating and Rendering a Partial View

Rendering a Partial Directly to the Response Stream

Passing ViewData to a Partial View

Passing an Explicit Model Object to a Partial View

Rendering a Partial View Using Server Tags

Passing ViewData to the Control

Passing an Explicit Model Object to the Control

Summary

CHAPTER 12 Models and Data Entry

How It All Fits Together

Templated View Helpers

Displaying and Editing Models Using Templated View Helpers

Using Model Metadata to Influence Templated View Helpers

Rendering Editors for Individual Properties

Rendering Labels for Individual Properties

The Built-in Editor Templates

Displaying Models Using Templated View Helpers

Using Partial Views to Define Custom Templates

Creating a Custom Editor Template

Respecting Formatting Metadata and Inheriting from ViewTemplateUserControl

Passing Additional View Data to Custom Templates

Working with HTML Field Prefixes and the TemplateInfo Context

Model Metadata

Working with Data Annotations

Creating a Custom Metadata Provider

The Full Set of Metadata Options

Consuming Model Metadata in Custom HTML Helpers

Using [MetadataType] to Define Metadata on a Buddy Class

Model Binding

Model-Binding to Action Method Parameters

Model-Binding to Custom Types

Specifying a Custom Prefix

Omitting a Prefix

Choosing a Subset of Properties to Bind

Invoking Model Binding Directly

Dealing with Model Binding Errors

Model-Binding to Arrays, Collections, and Dictionaries

Model-Binding Collections of Custom Types

Using Nonsequential Indexes

Model-Binding to a Dictionary

Creating a Custom Value Provider

Creating a Custom Model Binder

Configuring Which Model Binders Are Used

Using Model Binding to Receive File Uploads

Validation

Registering and Displaying Validation Errors

Using the Built-In Validation HTML Helpers

Controlling Where Validation Messages Appear

Distinguishing Property-Level Errors from Model-Level Errors

How the Framework Retains State After a Validation Failure

Performing Validation As Part of Model Binding

Specifying Validation Rules

Using Data Annotations Validation Attributes

Using the IDataErrorInfo Interface

Creating a Custom Validation Provider

Invoking Validation Manually

Using Client-Side Validation

Using Client-Side Validation with a Validation Summary

Dynamically Highlighting Valid and Invalid Fields

Allowing Specific Buttons to Bypass Validation

How Client-Side Validation Works

Implementing Custom Client-Side Validation Logic

Reusing the Built-In Client-Side Validation Logic

Putting Your Model Layer in Charge of Validation

Summary

CHAPTER 13 User Interface Techniques

Wizards and Multistep Forms

Defining the Model

Navigation Through Multiple Steps

Collecting and Preserving Data

Completing the Wizard

Validation

Implementing a CAPTCHA

Creating an Html.Captcha() Helper

Rendering a Dynamic Image

Distorting the Text

Verifying the Form Submission

Using Child Actions to Create Reusable Widgets with Application Logic

How the Html.RenderAction Helper Invokes Child Actions

When It’s Appropriate to Use Child Actions

Creating a Widget Based on a Child Action

Capturing a Child Action’s Output As a String

Detecting Whether You’re Inside a Child Request

Restricting an Action to Handle Child Requests Only

Sharing Page Layouts Using Master Pages

Using Widgets in MVC View Master Pages

Method 1: Have Your Controller Put a Control-Specific Data Item into ViewData

Method 2: Use an Action Filter to Put a Control-Specific Data Item into ViewData

Method 3: Use Child Actions

Implementing a Custom View Engine

A View Engine That Renders XML Using XSLT

Step 1: Implement IViewEngine, or Derive a Class from VirtualPathProviderViewEngine

Step 2: Implement IView

Step 3: Use It

Step 4: Register Your View Engine with the Framework

Using Alternative View Engines

Using the NVelocity View Engine

Using the Brail View Engine

Using the NHaml View Engine

Using the Spark View Engine

Summary

CHAPTER 14 Ajax and Client Scripting

Why You Should Use a JavaScript Toolkit

ASP.NET MVC’s Ajax Helpers

Fetching Page Content Asynchronously Using Ajax.ActionLink

Passing Options to Ajax.ActionLink

Running JavaScript Functions Before or After Asynchronous Requests

Detecting Ajax Requests

Submitting Forms Asynchronously Using Ajax.BeginForm

Invoking JavaScript Commands from an Action Method

Reviewing ASP.NET MVC’s Ajax Helpers

Using jQuery with ASP.NET MVC

Referencing jQuery

Referencing jQuery on a Content Delivery Network

Basic jQuery Theory

Waiting for the DOM

Event Handling

Global Helpers

Unobtrusive JavaScript

Adding Client-Side Interactivity to an MVC View

Improvement 1: Zebra-Striping

Improvement 2: Confirm Before Deletion

Improvement 3: Hiding and Showing Sections of the Page

Ajax-Enabling Links and Forms

Unobtrusive JavaScript and Hijaxing

Hijaxing Links

Performing Partial Page Updates

Using live to Retain Behaviors After Partial Page Updates

Hijaxing Forms

Client/Server Data Transfer with JSON

A Note About JsonResult and GET Requests

Performing Cross-Domain JSON Requests Using JSONP

Fetching XML Data Using jQuery

Animations and Other Graphical Effects

jQuery UI’s Prebuilt UI Widgets

Example: A Sortable List

Summarizing jQuery

Summary

PART 3 Delivering SuccessfulASP.NET MVC 2 Projects

CHAPTER 15 Security and Vulnerability

All Input Can Be Forged

Forging HTTP Requests

Cross-Site Scripting and HTML Injection

Example XSS Vulnerability

Attack

Defense

ASP.NET’s Request Validation Feature

Request Validation: Good or Bad?

Disabling Request Validation

Customizing Request Validation Logic

Filtering HTML Using the HTML Agility Pack

JavaScript String Encoding and XSS

Session Hijacking

Defense via Client IP Address Checks

Defense by Setting the HttpOnly Flag on Cookies

Cross-Site Request Forgery

Attack

Defense

Preventing CSRF Using the Anti-Forgery Helpers

SQL Injection

Attack

Defense by Encoding Inputs

Defense Using Parameterized Queries

Defense Using Object-Relational Mapping

Using the MVC Framework Securely

Don’t Expose Action Methods Accidentally

Don’t Allow Model Binding to Change Sensitive Properties

Summary

CHAPTER 16 Deployment

Server Requirements

Building Your Application for Production Use

Controlling Dynamic Page Compilation

Detecting Compiler Errors in Views Before Deployment

Detecting Compiler Errors in Views Only When Building in Release Mode

IIS Basics

Understanding Web Sites and Virtual Directories

Binding Web Sites to Hostnames, IP Addresses, and Ports

Deploying Your Application

Manually Copying Application Files to the Server

Where Should I Put My Application?

Bin-Deploying ASP.NET MVC 2

Deploying to IIS 6 on Windows Server 2003

Adding and Configuring a New MVC Web Site in IIS Manager

How IIS 6 Processes Requests

Making Extensionless URLs Work on IIS 6

Using a Wildcard Map

Disadvantages of Using Wildcard Maps

Excluding Certain Subdirectories from a Wildcard Map

Using a Traditional ASP.NET File Name Extension

Using a Custom File Name Extension

Extensionless URLs on IIS 6 with .NET 4

Troubleshooting IIS 6 Errors

Deploying to IIS 7.x on Windows Server 2008/2008 R2

Installing IIS 7.x on Windows Server 2008/2008 R2

Adding and Configuring a New MVC Web Site in IIS 7.x

How IIS 7.x Processes Requests in Classic Pipeline Mode

How IIS 7.x Processes Requests in Integrated Pipeline Mode

How Integrated Mode Makes Extensionless URLs Easy

Why Extensionless URLs Work on IIS 7.x Integrated Pipeline Mode with .NET 3.5

Why Extensionless URLs Work in IIS 7.x Integrated Pipeline Mode with .NET 4

Further IIS 7.x Deployment Considerations

Troubleshooting IIS 7.x Errors

Deploying to IIS 7.5 on Windows Server 2008 R2 Core

Automating Deployments with WebDeploy and Visual Studio 2010

Transforming Configuration Files

Automating Online Deployments with One-Click Publishing

Automating Offline Deployments with Packaging

Summary

CHAPTER 17 ASP.NET Platform Features

Windows Authentication

Preventing or Limiting Anonymous Access

Forms Authentication

Setting Up Forms Authentication

Handling Login Attempts

Using Cookieless Forms Authentication

Membership, Roles, and Profiles

Setting Up a Membership Provider

Setting Up SqlMembershipProvider

Using a SQL Server Express User Instance Database

Preparing Your Own Database for Membership, Roles, and Profiles

Managing Members Using the Web Administration Tool

Managing Members Using IIS 7.x’s .NET Users Configuration Tool

Using a Membership Provider with Forms Authentication

Creating a Custom Membership Provider

Setting Up and Using Roles

Using the Built-In SqlRoleProvider

Securing Controllers and Actions by Role

Creating a Custom Roles Provider

Setting Up and Using Profiles

Using the Built-In SqlProfileProvider

Configuring, Reading, and Writing Profile Data

Creating a Custom Profile Provider

URL-Based Authorization

Configuration

Configuring Connection Strings

Configuring Arbitrary Key/Value Pairs

Defining Configuration Sections to Configure Arbitrary Data Structures

Data Caching

Reading and Writing Cache Data

Using Advanced Cache Features

Site Maps

Setting Up and Using Site Maps

Creating a Custom Navigation Control with the Site Maps API

Generating Site Map URLs from Routing Data

Using Security Trimming

Internationalization

Setting Up Localization

Tips for Working with Resource Files

Using Placeholders in Resource Strings

Internationalizing Validation

Globalizing Validation Rules

Localizing Data Annotations Validation Messages

Localizing the Client-Side Number Validation Message

Performance

HTTP Compression

Tracing and Monitoring

Monitoring Page Generation Times

Monitoring LINQ to SQL Database Queries

Summary

CHAPTER 18 Upgrading and CombiningASP.NET Technologies

Using ASP.NET MVC in a Web Forms Application

Upgrading an ASP.NET Web Forms Application to Support MVC

Changing the Project Type

Adding Assembly References

Enabling and Configuring Routing

Adding Controllers and Views

Interactions Between Web Forms Pages and MVC Controllers

Linking and Redirecting from Web Forms Pages to MVC Actions

Transferring Data Between MVC and Web Forms

Using Web Forms Technologies in an MVC Application

Using Web Forms Controls in MVC Views

Using Web Forms Pages in an MVC Web Application

Adding Routing Support for Web Forms Pages

Web Forms Routing on .NET 4

Web Forms Routing on .NET 3.5

A Note About URL-Based Authorization

Upgrading from ASP.NET MVC 1

Using Visual Studio 2010’s Built-In Upgrade Wizard

Upgrading to .NET 4

Other Ways to Upgrade

A Post-Upgrade Checklist

Avoiding Anti-Forgery Token Problems Next Time You Deploy

Summary

Index