1. Programming ASP.NET 2.0 Krishna Kumar Academic Developer Evangelist Microsoft Corp. Krishna.Kumar@microsoft.com

2. Agenda Introduction to Web Development Module 1 – Architecture and Web Forms Module 2 – User Interface Elements Module 3 – Data Binding Module 4 – State Management Module 5 – Membership and Security Wrap Up

3. Introduction to Web Development Browser based Applications Little or no client install Platform independent Standards based – HTTP, [X]HTML Client Server Architecture ConventionalContemporaryHTTP Request (Verb, URI, Version, Headers, Body) Response (Status Code, Headers, Body)

4. Dynamic Web Content Dynamically generated HTML requires server host An engine that exposes an API to emit content Traditional hosts on Microsoft platform include: IIS with CGI IIS with ISAPI IIS with ASP IIS with ASP.NET

5. Module 1a – ASP.NET Architecture

6. Where does ASP.NET fit in?

7. Hosting ASP.NET with IIS6

8. Demo: Simple.aspx page

9. Page Compilation ASPX page is compiled upon first access Temporary ASP.NET files ASPX is a class Inherits from the Page class Server side script blocks are added to the class definition (member vars. & fns.) Interspersed script is added to a Render function (executable code) You work with ASP.NET by Building additional classes Extending Base classes Controlling class generation from.ASPX files Back to the DEMO

10. Code Behind Pages support inheritance from custom base class Base class specified with Inherits directive Promotes separation of code from presentation Three options for compiling code behind class Demand compiled using the ‘codefile’ directive and src placed in the same directory as the page Demand compiled and src placed in a directory named ~/App_Code at the top level of the application Precompiled and the assembly placed in a directory named ~/bin at the top level of the application Shadow Copy (~/bin assemblies) DEMO

11. Module 1b – Web Forms & Controls

12. Control Based programming Familiar Paradigm from desktop application development A program consists of a collection of controls Each control knows how to render to the screen The developer manipulates the state of these controls and lets rendering happen implicitly ASP.NET brings control based programming to web apps Server side objects created to represent elements of a page Each server side object capable of rendering as HTML Layered on top of HTTP’s Request/Response model Some desktop paradigms work well – others must be rethought

13. Demo: Control based.aspx page

14. Server side controls Server side controls: So called as they exist on the server and provide rendering to the client as HTML Created using ‘runat=server’ attribute on traditional HTML elements in a.aspx page Can be referenced within server side code using ID Implicitly added as member variables to the generated Page-derived class definition State Management Initial GET request creates controls with default values Subsequent POST back requests create controls and initialize them with values from the post body ViewState for non POSTable information

15. Page Lifecycle Each request to a page results in a new instance of that class Page goes through a lifecycle during request Exposes events that you can handle to interact with the page at various points during the request 5 primary events called in sequence during a page’s lifetime Possible to subscribe to these events in 3 ways Defining functions named Page_XXX with AutoEventWireup set to True Explicitly subscribing a delegate to that event Overriding virtual function handlers in base class

16. Event Sequence

17. Control Events Can handle control events in 2 ways: Declarative Event Subscription Indicating your handler function with the OnEvent attribute in the control’s tag Explicit Event Subscription Construct a new instance of the eventHandler delegate and initialize it with you handler function pointer Subscribe the delegate to the control’s event Hint: If using VS2005, just double click the control to get the event handler setup automatically

18. Detailed Event Sequence

19. User Controls User controls provide a simple way of defining composite controls You can take any.aspx page and turn it into a ‘user control’ User controls are defined in.ascx pages and use the @Control directive instead of @Page Using user controls Clients reference user controls using the @Register directive specifying the.ascx file in the Src attribute DEMO

20. Summary Prominence of Web Development HTTP pipeline / architecture ASP.NET architecture Page Compilation Demarcation between presentation and processing Controls based programming Page Lifecycle Event handling

21. Module 2 – User Interface Elements MasterPages, Themes, Skins and Navigation

22. Master Pages Application wide templates Partitioned into two blocks Blocks of HTML and code that apply to all pages Content blocks (ContentPlaceHolder ) ContentPlaceHolder are sections that are filled in by individual pages in the site Page designates the master via the MasterPageFile property Designer and IDE supported

23. Page before and after Master Page

24. Demo: Master Page Demo

25. Associating Pages Can have multiple Master Pages per site Associate each via MasterPageFile attribute To change via code, must be done before or during Page.PreInit Can configure all pages in a site to use one Master Page Pages element in Web.Config Will only apply to pages that use the correct content control declarations Individual pages can override Relative Paths Use the ASP.NET root path syntax (“~/ ”) ASP.NET will expand the URL to be correct relative from the local folder to the root of the application

26. Themes Theme: a great tool for consolidation of UI elements (CSS, Images, resources etc.) A named set of styles Each theme has a folder inside app_themes *Each CSS file in the theme folder embedded as a link in the rendered page* Applying a Theme Set via ‘Theme’ attribute in the Page directive Theme DEMO

27. Skins Another way to customize styles ‘CSS’ for ASP.NET Server side controls.skin files are placed inside the named Theme folders Can have multiple skin files in a folder Theme as a whole is applied by name A.skin file contains server side control declarations with default attributes Default skins and ID’d skins By default,.skin properties override local properties Use @Page 'StyleSheetTheme' for the inverse Exempt controls or pages from themes with EnableTheming='false' Skins DEMO

28. Navigation Three new controls targeted at site navigation TreeView Hierarchical rendering with images and text Menu Both dynamic and static rendering supported SiteMapPath 'Breadcrumbs' control All three controls can use SiteMapProvider Default data source draws from web.sitemap Site map data (for page navigation) is kept in an XML file named “web.sitemap”

29. Demo: Navigation

30. How it all ties together… SiteMapDataSource uses the default SiteMapProvider Defaults to XmlSiteMapProvider implementation which reads XML data from web.sitemap file

31. Summary Master pages Standard implementation of templated pages Designer / runtime support Themes and skins Collection of pluggable UI elements Unify images,.css, and control declarations New navigation controls Standard implementations of Menu, Tree, and SiteMapPath Flexible, provider driven (or data source driven) UI is extremely customizable

32. Module 3 – Data Binding

33. Fundamentals Data binding is a process of populating a control with data from a data source Controls that support data binding expose- A property called DataSource A method called DataBind To bind data to a control, initialize its DataSource to a data source and invoke its DataBind method Page code can avoid looping over data

34. Data Source Controls

35. Declarative Data Binding Meant to reduce the amount of code written - data binding can now be accomplished with no code Declare everything needed Let framework do heavy lifting Declarative data source controls to access data source Declare how to select, update, instert and/or delete Can provide parameters Parameter sources declaratively chosen Extensive designer support Integration with server explorer Standard binding model easily customized

36. New Data Bound Controls GridView Displays a row in a table for each row from data source Supports automatic paging and sorting Repeater Displays multiple items for each row from data source Data and layout defined via templates DataList Displays one cell in table for each row from data source Data and layout defined via templates DetailsView Displays one row from data source Layout predefined in HTML table FormsView Displays one row from data source Data and layout defined via templates

37. Demo: Data Binding

38. New Data Bound Controls

39. Parameters Data source controls can accept parameters Parameter sources are declarative Values automatically read Parameter types depend upon source of value Parameter types ControlParameter Value retrieved from the property of any server control on the page CookieParameter Value retrieved from the cookie in request FormParameter Value retrieved from HTTP POST variable ProfileParameter Value retrieved from Client profile information QueryStringParameter Value retrieved from QueryString SessionParameter Value retrieved from Client Session

40. Parameters – SqlDataSource - Text Bound parameters can be used to populate any of the parameters in a data source Parameters most common along with accompanying expression

41. Templates Allows customization of databound controls Customize layout Customize data Customize layout by choosing markup in template Customize data by choosing data binding expressions for read only data for read only data for editable data for editable data Different templates for viewing, editing, inserting Well known CommandName to switch modes

42. Templates

43. Connection String Storage ConnectionStrings section in Web.Config New syntax for retrieving config file values

44. Summary Most controls in ASP.NET can have data bound to them Declarative model provides a higher order framework for data binding Declarative data sources Reduce code, move data access code into framework Data Binding Implicit with declarative data sources New rich data controls Several new controls including the GridView and DetailsView Parameters Each data source is completely customizable with parameters Templates New DataBinding Syntax – and New DataBinding Syntax – and Connection String storage New storage location in web.config

45. Module 4 – State Management

46. Client state Keeping track of client activity, as they move between different physical pages in your ASP.NET application How to accumulate and maintain state between page invocations Hard problem to solve since HTTP is a stateless protocol Various ways of storing state on behalf of clients SessionProfiles

47. Session State Session state is used to store individual data for a user during application transaction Session state is scoped by a single client session, and is tagged with a unique Session ID The session ID is transmitted between client and server using cookies (or mangled URLs if cookieless mode is enabled) Accessed through the Session property of the page, which references the current HttpSession object provided by the HTTP runtime Works regardless in both single page and multiple page programming models

48. Demo: Session

49. Improvements in session state in ASP.NET Several improvements to the way session state works in ASP.NET 2.0 Can avoid relying on cookies to track clients Cookieless mode of ‘autodetect’ Can configure to survive process shutdown Can configure to work across machines in a web farm Fully extensible provider based model Pluggable ID generator

50. Autodetect cookieless mode

51. Session key maintained with cookies

52. Session key maintained with URL Mangling

53. Profile Per-user data storage that is persistent Profile prover manages persistence Keys off of authenticated user Optionally supports anonymous users Supports strongly typed property data – usage easier than Sessions Working with profiles: Define the properties for the Profile inside web.config The above properties are now available as properties on the Profile property of the Page

54. Accessing profile information

55. Demo: Profile

56. Saving profile data Profile data is saved automatically Saved after every page request By default, a local SQL Server 2005 database file is generated (under App_Data) with ASP.NET tables to store profile and membership information

57. Migrating anonymous profile data Transition from unauthenticated to authenticated fires event Opportunity to transfer profile information from anonymous user to authenticated user

58. Summary Client State Management Sessions Session state is client-specific tied to browser session Profiles Is client-specific tied to authenticated user Can be tied to anonymous user

59. Module 5 – Membership and Security

60. Outline SecurityMembership Security Controls Membership Provider Role Provider

61. Security in ASP.NET ASP.NET provides security features in addition to those provided by IIS Oriented around client authentication Several method available for integrating authentication into your pages Managed through web.config Accessing authenticated client information The User property of the Page class provides access to current client information

62. Authentication and Authorization Authentication Modes Mode=NoneMode=WindowsMode=Forms Authorizing clients Authorization element used to describe which clients are granted access Supports sub elements allow and deny Users, roles, verbs ? represents anonymous * represents all clients The first match found (allow or deny) determines authorization

63. Windows Authentication Users credentials defined in active directory Leverage IIS to perform authentication IIS challenges browser by sending a 401 status code IIS forwards the username to ASP.NET

64. Forms Authentication Common approach for performing application-level authentication Application manages storage of credentials Application handles authentication FormsAuthentication class Credential Management and storage

65. Security ‘providers’ for common tasks Membership providers Works with xxMembershipProvider to simplify common tasks in building security infrastructure CreateUser DeleteUser ChangePassword ValidateUser Role providers xxRoleProvider implements common role-based authorization features CreateRole IsUserInRole GetAllRoles GetRolesForUser Several new controls generate large pieces of security UI

66. Example: Login control Building a login page now consists of:

67. How it works…

68. Where’s the data?

69. Membership controls Several new controls available that tap into the membership and role providers login authentication form alternate views based on identity password retrieval form (only with un-hashed passwords) Status and hyperlink to login/logout based on the state displays username for authenticated users form for entering new users form for changing password

70. Demo: Authentication Controls

71. Controls rely on provider

72. Role based authorization Useful to develop pages by querying the current client’s role membership Avoids hard coded user names checks Can be used interchangeably with windows group/user model through IPrincipal.IsInRole() DEMO

73. Summary IIS security sits on top of ASP.NET security ASP.NET provides a rich authentication framework ASP.NET enables site level management of security New membership provider + security controls Greatly simplifies building complex security UIs Common infrastructure to 'do it right' Pluggable Integrated role support

74. © 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. Thank You. Please turn in the reviews!