softlogger Latest Articles ::XML-XSLT

Silverlight Browser Integration aka HTML Bridge

The Moth — 2008-03-08T00:00:00

Given that Silverlight applications sit in the browser via a plug in, it would be silly if you couldn't interact from managed SL code with other browser elements, such as html elements and script so that you could, for example, reuse existing assets. I have heard the browser-agnostic integration featured described as HTML Bridge and it is implemented in the System.Windows.Browser.dll assembly in a same named namespace. You can see the types from that namespace on the following image (click on it for the expanded version):

The important inheritance hierarchy to be aware of is that HtmlDocument and HtmlElement inherit from HtmlObject (that allows handling script events via AttachEvent) which inherits from ScriptObject (that allows you to execute scripts via its Invoke and InvokeSelf methods). HtmlPage is a great entry point because you can navigate across its Window property to an HtmlWindow (that allows e.g. to Navigate URLs) and across its Document property to an HtmlDocument (that offers e.g. access to Cookies and QueryString). Also note the 2 Attribute classes: ScriptableType and ScriptableMember. Those are used for exposing Silverlight managed classes to script in the browser combined with HtmlPage.RegisterScriptableObject and RegisterCreateableType methods. Open the expanded class diagram in a separate window and identify the aforementioned methods. Notice there how HtmlDocument allows you to create new elements and retrieve existing ones (CreateElement and GetElementById). Once you have references to those HtmlElements you can do things like SetAttribute, SetStyleAttribute and AppendChild to name a few. Script events are handled in your managed ScriptEventHandler method that accepts an HtmlEventArgs which you can find on the class diagram along with its relationships (e.g. MouseButtons). You should also checkout the HttpUtility class and its self-explanatory methods such as UrlEncode.

Phew! Take a moment to study the two class diagrams using the previous paragraph as a guide and also note that all links above are direct links to the API documentation (i.e. this blog post becomes my bookmark into MSDN ;)). You can also follow a quickstart (DOM access), two walkthroughs (calling managed from script and script from managed), and for those that want even more, follow this 2-hour lab (ZIP).

To see some of the browser integration in action, I have here the ugliest and most basic SL app that simply proves some of the concepts.

DOC, XLS and PPT Binary File Format Specifications Released (plus WMF, Windows Compound File [aka OLE 2.0 Structured Storage] and Ink Serialized Format Specifications and Translator to XML news)

Gregs Cool [Insert Clever Name] of the Day — 2008-02-20T00:00:00

Brian Jones: Open XML Formats - Binary Documentation (.doc, .xls, .ppt) and Translator Project Site are now live

"As promised last month, the binary documentation (.doc, .xls, .ppt) is now live. In addition to this, the project to create an open source translator (binary -> Open XML) has now been formed on sourceforge, and the development roadmap has been published. ...

...

Office Binary (doc, xls, ppt) Translator to Open XML

The "Office Binary (doc, xls, ppt) Translator to Open XML" project is now live on sourceforge: http://b2xtranslator.sourceforge.net/
...

While the project is still in its infancy, you can see what the planned project roadmap is, as well as an early draft of a mapping table between the Word binary format (.doc) and the Open XML format (.docx).

Microsoft Office Binary (doc, xls, ppt) File Formats

The binary documentation itself is available up here: http://www.microsoft.com/interop/docs/OfficeBinaryFormats.mspx

Word 97-2007 Binary File Format (.doc) Specification PDF | XPS
PowerPoint 97-2007 Binary File Format (.ppt) Specification PDF | XPS
Excel 97-2007 Binary File Format (.xls) Specification PDF | XPS
Office Drawing 97-2007 Binary Format Specification PDF | XPS

It's all covered under the Open Specification Promise.
Another great surprise in all of this is that we've made the documentation for a few other supporting technologies available as it may be of use to folks implementing the binary formats: http://www.microsoft.com/interop/docs/supportingtechnologies.mspx
The technologies included are:

Windows Compound Binary File Format Specification PDF | XPS
Windows Metafile Format (.wmf) Specification PDF | XPS
Ink Serialized Format (ISF) Specification PDF | XPS

..." [Post Leached 80%+]

I think this was a good move by Microsoft. Now what would be cool is to see them release more older file format specifications because they want to, not because they "have" too.

Embedding Arbitrary XML in Faults

Nicholas Allens Indigo Blog — 2008-02-20T00:00:00

How can I directly craft the XML content that goes into a fault detail?

Getting control over the detail element doesn't have to mean crafting the fault message yourself. While WCF requires that the fault detail be serializable using a data contract, remember that DataContractSerializer treats XmlElement as a special primitive type. This allows you to construct arbitrary content using XmlElement when your content can be represented as a rooted document. Due to the automatic conversion process of FaultException to a fault message, you don't need to construct a data contract to act as a wrapper.

Here's a sample that builds some content in an XmlElement and uses it to construct a fault. I made the method return a Message so that I could look at the response more easily but you can use any contract you want.

[ServiceContract]
public interface IMyService
{
   [OperationContract]
   Message Fail();
}

public class MyService : IMyService
{
   public Message Fail()
   {
      XmlDocument document = new XmlDocument();
      XmlElement root = document.CreateElement("tag");
      root.SetAttribute("attributeName", "value");
      XmlElement subtag = document.CreateElement("moretags");
      subtag.InnerText = "blah";
      root.AppendChild(subtag);
      throw new FaultException<XmlElement>(root);
   }
}

public class Program
{
   static void Main(string[] args)
   {
      string address = "http://localhost:8000/";
      BasicHttpBinding binding = new BasicHttpBinding();
      ServiceHost host = new ServiceHost(typeof(MyService), new Uri(address));
      host.AddServiceEndpoint(typeof(IMyService), binding, " ");
      host.Open();
      ChannelFactory<IMyService> factory = new ChannelFactory<IMyService>(binding);
      IMyService proxy = factory.CreateChannel(new EndpointAddress(address));
      Message response = proxy.Fail();
      Console.WriteLine(response.ToString());
      Console.ReadLine();
      host.Close();
   }
}

That code produces a fault message that looks like the following.

<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
  <s:Header />
  <s:Body>
    <s:Fault>
      <faultcode>s:Client</faultcode>
      <faultstring xml:lang="en-US">The creator of this fault did not specify a Reason.</faultstring>
      <detail>
        <tag attributeName="value">
          <moretags>blah</moretags>
        </tag>
      </detail>
    </s:Fault>
  </s:Body>
</s:Envelope>

Depending on how much hand-crafting you want, XmlDocument lets you simplify the process even further. For example, you could generate the same message from simple XML completely put together by hand.

XmlDocument document = new XmlDocument();
document.LoadXml("<tag attributeName=\"value\"><moretags>blah</moretags></tag>");
throw new FaultException<XmlElement>(document.FirstChild as XmlElement);

Next time: DataMember Best Practices

HTML Agility Pack (Think Managed HTML DOM Parser, with XPath)

Gregs Cool [Insert Clever Name] of the Day — 2008-01-20T00:00:00

I came across the HTML Agility Pack while researching an issue I was having using the XMLReader to parse a HTML page...

The issue was that the HTML was not well formed (imagine that). So I needed a more forgiving HTML parser. I didn't want to falling back to the WebControl, COM or interop with MSHTML. I just wanted a "HTMLReader" or simple HTML DOM parser.

That's what lead me to the HTML Agility Pack...

CodePlex - HTML Agility Pack

"...

Now, erhh... what is exactly the Html Agility Pack? All right, all right, I will tell you know:

This is an agile HTML parser that builds a read/write DOM and supports plain XPATH or XSLT (you actually don't HAVE to understand XPATH nor XSLT to use it, don't worry...). It is a .NET code library that allows you to parse "out of the web" HTML files. The parser is very tolerant with "real world" malformed HTML. The object model is very similar to what proposes System.Xml, but for HTML documents (or streams).
Sample applications:

Page fixing or generation. You can fix a page the way you want, modify the DOM, add nodes, copy nodes, well... you name it.
Web scanners. You can easily get to img/src or a/hrefs with a bunch XPATH queries.
Web scrapers. You can easily scrap any existing web page into an RSS feed for example, with just an XSLT file serving as the binding. An example of this is provided.

There is no dependency on anything else than .Net's XPATH implementation. There is no dependency on Internet Explorer's MSHTML dll or W3C's HTML tidy or ActiveX / COM object, or anything like that. There is also no adherence to XHTML or XML, although you can actually produce XML using the tool. ..."

With very little work I was able to rip out XMLReader and replace it with the HTML Agility Pack. And in the end, it let me write better code with fewer lines... And so far it's worked like a charm.

Dynamically Producing XAML files using XamlWriter.Save Method

Cool Stuff — 2008-01-15T00:00:00

The XamlWriter.Save is used to serialize the contents of a WPF application as a XAML file. I wrote a small sample in which we will be serializing the WPF objects to a XAML string

using System;

using System.Collections.Generic;

using System.Linq;

using System.Text;

using System.Windows;

using System.Windows.Controls;

using System.IO;

using System.Windows.Data;

using System.Windows.Markup;

using System.Windows.Media;

namespace TestXAML

{

class Program

{

[STAThread ]

static void Main(string[] args)

{

int[] arr = new int[5] ;

arr[0]=1;

arr[1]=2;

arr[2]=3;

arr[3]=4;

arr[4]=5;

ListBox objlst=new ListBox() ;

objlst.ItemsSource = arr;

objlst.Width = 200;

StackPanel MyStackPanel=new StackPanel();

SolidColorBrush brush = new SolidColorBrush();

brush.Color = Color.FromRgb(200, 100, 255);

MyStackPanel.Background = brush;

MyStackPanel.Children.Add(objlst);

string mystrXAML = XamlWriter.Save(MyStackPanel);

FileStream fs = File.Create("testfile.xaml");

StreamWriter sw = new StreamWriter(fs);

sw.Write(mystrXAML);

sw.Close();

fs.Close();

}

Building JavaScript Behaviors - 2

Aspects of AJAX — 2008-01-05T00:00:00

The sample from the last post about building JavaScript Behaviors is not very realistic, because it is not configurable and missing parameters.

Properties, Attributes and Parameters

The way parameters are passed to the behavior implementation is some kind of tricky:

you write down a parameter into the *.aspx source file.
when the page is called from the server the parameter is passed to the server side control.
the parameter is then written out into the response (html) stream and send to the client.
when the behavior is attached to the html element it is made available to javascript.
the behavior implementation is using the parameter by using this.parameter.

There are some traps and tricks on the way.

Take care of uppercase characters in the parameter name. Parameters with uppercase characters work fine on the server but using them on the client breaks the xhtml format spec. You can use lowercase parameters on the server and the client and you don't get confused when writing code for the server platform and the client platform the same time.

If you want to make a parameter available to the server control you have to add a public property or a public field to the class.

Using public fields is working fine but Visual Studio will not help with intellisense then so I prefer using a encapsulated private field using a public property:

private string _datatype = String.Empty;

public string datatype {
  get { return _datatype; }
  set { _datatype = value; }
} // datatype

public string working_but_no_intellisense = String.Empty;

Passing null through a parameter just doesn't work because you cannot specify an attribute for a xml or html tag with a null value. I am using empty strings instead.

If no attribute value is specified in the source code you need to define a default value. The easiest is to assign the default value to the private server field declaration and always render the attribute into the response stream.

The firefox browser makes a big difference between attributes of a html element and a property of an object so when attaching a behavior to a html element all the attributes are copied into object properties.

Don't use any reserved words you know from C#, VB.NET, JAVA, JavaScript, HTML or the DOM specification as a name and don't start a name with "on" because this naming convention is used for identifying event handlers.

1. Adding a parameter to the dice sample server control

The sample up to now is only showing random numbers from 1 to 6. A new parameter named "maxnumber" should make it possible to get random numbers between 1 and any positive number greater than 2.:

private int _maxnumber = 6;

public int maxnumber {
  get { return _maxnumber; }
  set { _maxnumber = value; }
} // maxnumber

This parameter is not needed on the server side and we just pass it to the client through a html attribute:

<div id="<%=this.ClientID %>" class="Wuerfel" maxnumber="<%=this.maxnumber %>"
  unselectable="on">click</div>

You can find this implementation in wuerfel2.ascx.

2. Adding a parameter to the behavior

On the client side we need to declare tha parameter as well. The given assignment will always be overwritten be the attribute the server adds to the html element.

And then we must use.

// parameter to set the maximum number
maxnumber : 6,

// find a random number
var n = Math.floor(Math.random()*(this.maxnumber-1))+1;

You can find this implementation in wuerfel2.js.

3. Using the new feature

Now the new parameter can be used on any wuerfel2 tag:

<uc1:Wuerfel2 ID="Wuerfel2" maxnumber="42" runat="server" />

You can find it in Wuerfel_05.aspx.

You can download the updated files from http://www.mathertel.de/Downloads/Start_JSBTutorial.aspx.

del.icio.us tags: JavaScript, behaviour, usercontrols

Tree view Ajax control update

Aspects of AJAX — 2008-01-05T00:00:00

The tree view control was introduced some time ago and some details of its implementation can be found at http://ajaxaspects.blogspot.com/2006/01/tree-view-ajax-control.html or in the book at http://www.mathertel.de/AJAXEngine/documentation/AJAXeBook.aspx.

Now there is an update available and also a step by step sample how to use this control inside your web application.

The sample page can be found at: http://www.mathertel.de/AJAXEngine/S03_AJAXControls/TreeView.aspx.

1. Building a web service

Using Ajax with a tree view control is based on the idea that the full data that builds a complete tree might have a size that cannot be downloaded to the browser in one time. The server therefore has to offer a method that enables downloading fragments of a hierarchic data structure exactly in that moment when the user opens a new sub tree.

The tree view Ajax control binds to a webservice with only one function GetSubNodes(string path) that has to be built for your specific solution. If you like you can also use a different name for the method.

The structure of the XML node that must be returned by this method looks like this:

<tree>
  <folder name="AK" title="Alaska">
  <file title="Aguila" name="ZIP85320" link="http://weather.aol.com/main.adp?location=USAZ0001"/>
  <file title="Ajo" name="ZIP85920" />
  <file name="Redmond" img="redfile" />
  <file name="Alpine" />
  <file name="Yuma" />
</tree>

The outer element must be a <tree> node that contains <folder> and <file> nodes.

As you can see the name attributes do have a special purpose in this structure because the values of these nodes together and separated by slashes will build a path to each available element for example "/AZ/Ash Fork".

When clicking onto folders and files this path will be used for loading a subtree or for the events that are published when a final <file> node is clicked.

The title attribute is optional. Its text will be displayed behind the icon. If it's not present the name will be used instead.

The link attribute can be used when a click on a final node should just open a regular hyperlink.

When there is no link present on a file node an OpenAjax event "de.mathertel.treeview.click" with the path of the node in the data is published. You can register to this event for catch all clicks if no navigation is required.

You can find a webservice implementation here and here.

Having built such a web service most of the work is done.

2. importing the webservice

The webservice must be made available on the page containing the Ajax tree view control by using a simple JavaScript include:

<script type="text/javascript"
   src="../ajaxcore/GetJavaScriptProxy.aspx?service=../S03_AJAXControls/TreeView.asmx"></script>

Now the webservice is available through the proxies.TreeView object and the GetSubNodes method can be called by using the generated proxies.TreeView.GetSubNodes() function.

3. embedding the Ajax tree view control

The control is implemented as a user control in the file ~/controls/TreeView.ascx. If you use Visual Studio 2005 you can drag this file onto a page and the control will be registered for this page or you can register the control by using a @Register tag at the beginning of the page:

<%@ Register Src="../controls/TreeView.ascx" TagName="TreeView" TagPrefix="ajax" %>

The other way to register a user control is putting an option into the web.config file. This is the better solution if you want to reuse the control on multiple pages and like to use the same prefix all over the web application.

<configuration>
  <system.web>
    <pages>
      <controls> 
<add src="~/controls/TreeView.ascx" tagName="TreeView" tagPrefix="ajax"/>

The control itself can be used now:

<ajax:TreeView ID="TreeView1" runat="server" 
  service="proxies.TreeView.GetSubNodes" title="Cities in the USA" />

You can see the complete source of the page by using this link: [view source of TreeView.aspx].

4. CSS and specific icons

Some tree view might not only use folders and files so there is a special feature for that too.

The CSS code that is used by the tree view control is shown here:

div.TreeView .du {height:18px;overflow:hidden;cursor:hand; 
  background-image:url(controls/images/dc.png);background-repeat:no-repeat}
div.TreeView .do {height:18px;overflow:hidden;cursor:hand;
  background-image:url(controls/images/do.png);background-repeat:no-repeat}
div.TreeView .dc {height:18px;overflow:hidden;cursor:hand;
  background-image:url(controls/images/dc.png);background-repeat:no-repeat}
div.TreeView .de {height:18px;overflow:hidden;
  background-image:url(controls/images/de.png);background-repeat:no-repeat}
div.TreeView .fl {height:18px;overflow:hidden;
  background-image:url(controls/images/file.png);background-repeat:no-repeat}
div.TreeView .ft {padding-left:40px}
div.TreeView .subframe {margin-left:18px;}

Using these short classnames for attaching the style results in small html code fragments and you can link to the right images just by modifying the style rules. I put this baseline definition into the main css include file of the web application.

By specifying the img attribute on a file node in the data that is returned from the server another classname can be included for the ft-class elements. To avoid individual image tags in the tree view this classname extension also is handled by using a style rule that you can add:

div.TreeView .fl.redfile {background-image:url(../controls/images/redfile.png)}

This definition can be found in the sample page itself but you can also put it into the mail css include file if you like. Search for Redmond(WA) to see it work.

5. handling the events

If you just like to show information in a tree fashion and like to use hyperlinks on the file nodes you don't need to have a look at the eventing system that is also built in.

When clicking a file node and if there is no hyperlink set then the tree view controls publishes an event that event handlers can catch. The eventing system that is used here is the OpenAjax compatible event hub. You can find the documentation about it on the http://www.OpenAjax.org site and the implementation is part of the ~/controls/jcl.js file that is included automatically.

To register for such an event you need a little bit of JavaScript code:

// a function that will catch the tree events by listening to de.mathertel.treeview.**.
function showTreeEvent(name, data) {
  alert("click on " + data);
} // showTreeEvent

OpenAjax.hub.subscribe("de.mathertel.treeview.**", showTreeEvent);

The OpenAjax.hub.subscribe is registering the showTreeEvent function and this function will be passed the name of the event and the path in the data payload.

About the updated features

New to the current implementation is the support for the link attribute in the <file> elements and the publishing of events when clicking final nodes.

If you want to see more features or want to have more supported scenarios then let me know by using the feature request function on http://sourceforge.net/projects/ajaxengine/.

Get a Real XML Parser

Nicholas Allens Indigo Blog — 2008-01-03T00:00:00

Today's post is more observational than informational. Enjoy.

It's sometimes possible to write XML without having an XML library. If your XML documents are sufficiently similar and templated, then you can craft validly formed XML through little more than string manipulation. The trivial case is where the string is a constant expression and the XML document is actually the same every time through. The more interesting case is where the string has many spots where you can fill-in-the-blank with arbitrary content. Once that content becomes constrained instead of arbitrary, you'll almost always want to make use of an XML library assuming that you want your emitted messages to be validated.

It's pretty much impossible to read XML without having an XML library. XML simply has too many rules about whitespace handling, processing instructions, character formats, and nested elements to realistically build hand-crafted parsers in an application. A hand-crafted parser likely supports exactly the message that you saw one day looking at the wire but contains numerous bugs that prevent all of the equivalent ways of writing the same message from being accepted. Even seemingly unimportant changes to the network configuration can result in literal changes, such as the text encoding or the division of text into text nodes expected by a DOM. If you want to understand XML, then you'll need to get a real XML parser. Using an XML parser instead of string manipulation is more expensive but if you can't afford this cost, then you probably can't afford the benefits that XML provides either.

Next time: Accessing the Query String

Linq to XML code samples

Doug Mahugh — 2007-12-11T00:00:00

Well, that didn't take long: Eric White has already posted a series of blog posts on using Linq to XML with Open XML. He covers the basics of packages and parts, and then presents an OpenXMLDocument class that converts any Open XML document into a hierarchical object graph on which it is easy to write LINQ to XML queries. An XDocument XML is created for each part in the package, and you can then write LINQ to XML queries over multiple parts easily.

From the comment thread on Eric's blog, I learned that James Newton-King has also posted a Ling to XML sample for Open XML development. An idea whose time has come, apparently!

James's "Linq to XML over large documents post" focuses more on the performance aspects of Linq to XML, and how it provides for a smaller memory footprint than a DOM-based approach. He describes how you can combine Linq to XML with XMLReader to get the best of both worlds: flexible and simple development, and minimal memory usage resulting in great performance.

If you're interested in learning a lot more abobut how Linq to XML can help streamline your Open XML development work, be sure to add these two blogs to your RSS feeds:

Resolving Conflicts in Serialization

Nicholas Allens Indigo Blog — 2007-12-11T00:00:00

DataContractSerializer supports multiple serialization mechanisms. If more than one serialization mechanism is specified for the same type, which one gets used?

Experimentation is the easiest way to figure out what happens. I'll look at different combinations of the XML serializer, the data contract serializer, and the "collection-based" data contract serializer, which is the default mechanism for the concrete collection classes.

Let's start with a base interface that defines a member for the type.

public interface IFoo
{
   string data { get; set; }
}

Now, let's apply various combinations of serialization mechanisms to implementations of the base interface. I'll start with each of the serializers by themselves and then each of the legal combinations. Data contracts and collection data contracts can't be used at the same time so that pairing isn't possible as well as trying to use all three serialization mechanisms at once.

Here's a quick test program to run through the combinations.

public class Program
{
   [DataContract]
   public class FooDataContract : IFoo
   {
      [DataMember]
      public string data { get; set; }
   }

   [Serializable]
   public class FooSerializable : IFoo
   {
      public string data { get; set; }
   }

   [CollectionDataContract]
   public class FooCollection : List<int>, IFoo
   {
      [DataMember]
      public string data { get; set; }
   }

   [Serializable]
   [DataContract]
   public class FooSerializableDataContract : IFoo
   {
      [DataMember]
      public string data { get; set; }
   }

   [Serializable]
   [CollectionDataContract]
   public class FooSerializableCollection : List<int>, IFoo
   {
      [DataMember]
      public string data { get; set; }
   }

   static void Main(string[] args)
   {
      using (XmlTextWriter writer = new XmlTextWriter(Console.Out))
      {
         foreach (Type type in typeof(Program).GetNestedTypes())
         {
            IFoo foo = (IFoo)type.InvokeMember(null, BindingFlags.CreateInstance, null, null, null);
            foo.data = type.Name;
            DataContractSerializer serializer = new DataContractSerializer(type);
            writer.WriteString(type.Name);
            writer.WriteWhitespace("\n");
            serializer.WriteObject(writer, foo);
            writer.WriteWhitespace("\n\n");
         }
      }
      Console.ReadLine();
   }
}

That gives us a set of outputs to inspect to see what serializer won.

FooDataContract

<Program.FooDataContract xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/"><data>FooDataContract</data></Program.FooDataContract>

FooSerializable

<Program.FooSerializable xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/"><_x003C_data_x003E_k__BackingField>FooSerializable</_x003C_data_x003E_k__BackingField></Program.FooSerializable>

FooCollection

<Program.FooCollection xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/" />

FooSerializableDataContract

<Program.FooSerializableDataContract xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/"><data>FooSerializableDataContract</data></Program.FooSerializableDataContract>

FooSerializableCollection

<Program.FooSerializableCollection xmlns:i="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://schemas.datacontract.org/2004/07/" />

FooDataContract gave us the data member with the nice format for properties.
FooSerializable gave us the data member with the ugly format for properties.
FooCollection failed to give us the data member (CollectionDataContract doesn't let you have non-default members).
FooSerializableDataContract is the same as FooDataContract. DataContract beats Serializable.
FooSerializableCollection is the same as FooCollection. CollectionDataContract beats Serializable as well.

Next time: TCP Keep Alive

Use the provider model in ASP.NET 2.0

.NET slave — 2007-12-10T00:00:00

I think by now, most ASP.NET developers have come across some of the different provider models in ASP.NET 2.0. Most likely the Membership, Roles and SiteMap provider but also the custom provider model that you can use to create your own providers.

Still, I often come across custom authentication and authorization mechanisms instead of using the Membership and Roles provider model. Typically, a business object called User has a Logon method that does the authentication and returns a Boolean back to the login page, which sets a cookie and maybe session variable and then redirects the user to the password protected area of the website.

Then there’s usual also some custom authorization mechanism that prevents certain logged in users from certain areas such as admin pages. The menu is custom designed to hide and show only the pages available to the current user and the individual pages also makes the checks.

That is a common scenario and I see it very often. If you have such a scenario on your web application, then consider converting your existing logic to use the provider model. By creating a custom implementation of the Membership, Roles and SiteMap provider, you get all this for free and it is very simple to do so. You can keep your existing code and then build the providers on top of that.

The benefit is that these three providers work together so that the SiteMap automatically shows only the pages a user has permissions to see based on her role. You also get the cookie management for free. But the best part is that you can easily switch to a new provider when needed without changing your existing code. I did that today when I installed BlogEngine.NET on our intranet at ZYB. It had to use the Active Directory Membership provider so that we could log on using our network credentials. It took me 5 minutes to make the transition from my custom XML Membership provider to the Active Directory one. There’s a good guide at MSDN for using the Active Directory provider.

That flexibility comes free of charge with ASP.NET 2.0 and makes the lives of all .NET web developers much easier, more flexible and powerful. I have published my XML Membership provider and will wrap up the XML Roles provider soon and publish it as well.

When you first try the provider model, I promise that you’ll never go back.

Resources

Cross Site Scripting Joy: XSS in detail

Ajaxian — 2007-12-05T00:00:00

In Cross Site Scripting Joy, Andrew Betts has taken the time to go into real detail on XSS and the fun and frolics that we have with the Same Origin Policy and beyond:

So the battle over XSS as a security problem has moved on from the same origin policy, but same origin remains a massive obstacle to development of useful non-malicious services, and that’s particularly true of Comet, because there are typically two servers involved in any comet setup: a web server like Apache, and a comet server like Meteor or Orbited.

There are essentially three choices for making these two servers play together:

marry them: have one server that serves both your Comet connections and the standard ones (including any dynamically generated content);

have a regular web server with a Comet server sitting in front of it, so all connections are made to the Comet server, and it proxies the non-comet connections to the web server;

have both the Comet and the regular web server exposed to the web, and request applicable content from each one.

Andrew then decided to write a bunch of tests (38 in fact) to see how the SOP is implemented in various browsers, and ended up with the following thorough information: