Shiju Varghese's Blog

ASP.NET MVC 2 Preview 1 Released

shiju — Fri, 31 Jul 2009 08:46:00 GMT

Microsoft has released Preview 1 version of ASP.NET MVC 2. You can download ASP.NET MVC 2 Preview 1 from here. The new features are Templated Helpers, Areas and Support for Data Annotations. For more details visit the following links

ScottGu on ASP.NET MVC V2 Preview 1 Released

Phil Haack on ASP.NET MVC 2 Preview 1 Released

Walkthrough: Using Templated Helpers to Display Data

Walkthrough: Organizing an ASP.NET MVC Application by Logical Areas

How to: Validate Model Data Using DataAnnotations Attributes

Introduction to Test-Driven Development with ASP.NET MVC

shiju — Wed, 22 Jul 2009 16:27:00 GMT

One of the greatest advantages of ASP.NET MVC is the support of testability, which enables to Test-Driven Development (TDD) in an easy manner. A testable application should be developed in a loosely coupled manner so that you can test the independent parts of the application. For developing testable applications, the support of developer frameworks is very important and the frameworks should be designed to facilitate building testable applications. One of the design goals of ASP.NET MVC was testability so that you can easily develop testable application with the ASP.NET MVC framework. In this post, I will give an introduction to Test-Driven Development (TDD) with ASP.NET MVC using NUnit unit test framework.

Introduction to Test-Driven Development

TDD is a design approach that follows a Test First development where you write a test before you write just enough production code to fulfill that test and refactoring. The TDD model development is also known as Red-Green-Refactor style development.

The following are the workflow of TDD

1. Requirement identified

2. Write an automated test

3. Run tests and make sure new one FAILS (RED)

4. Write some code

5. Run tests to make sure all PASS (GREEN)

6. Refactor

7. Repeat

In this example, I will explain a scenario where users can view list of categories and also able to add new category into the application. The following are the behaviors of our simple reference application

1. Users should be able to view list of Categories

2. The category list should support paging

3. The Category Name should be mandatory while creating a new Category

Code listings of the application

Category model

public class Category {
      public int CategoryID { get; set; }
      public string Name { get; set; }
      public string Description { get; set; }      
  }

ICategoryRepository

public interface ICategoryRepository {
       IQueryable<Category> GetCategories();
       void Save(Category category);
       void Delete(int id);
       Category Read(int id);
   }

ICategoryService

public interface ICategoryService {
        IQueryable<Category> GetCategories();
        void Save(Category category);
        Category Read(int id);
        void Delete(int id);
    }

CategoryController - List Action

public ActionResult List(int? page)
 {
      return View();
  }

Currently the List action method does not contain any implmentation logic. We will write the implementation code after writing a failure test.

Unit Tests

In TDD, we start with writing a failure test. In this post, I am using NUnit for unit test. You can download NUnit from http://NUnit.org. If you want a NUnit test template for ASP.NET MVC, check the blog post Updated NUnit Templates for ASP.Net MVC 1.0 RTM .

The below is the test for the behaviours of the category list

[TestFixture]
class CategoryControllerTest
{
Mock<ICategoryRepository> _repository;
ICategoryService _service;

[SetUp]
public void Setup()
{
    _repository = new Mock<ICategoryRepository>();
    _service = new CategoryService(_repository.Object);
}
[Test]
public void List()
{
    IQueryable<Category> fakeCategories = new List<Category> {
    new Category { Name = "Test1", Description="Test1Desc"},
    new Category { Name = "Test2", Description="Test2Desc"},
    new Category { Name = "Test3", Description="Test3Desc"}
}.AsQueryable();
_repository.Setup(x => x.GetCategories()).Returns(fakeCategories);
CategoryController controller = new CategoryController(_service);
// Act
ViewResult result = controller.List(null) as ViewResult;
// Assert
Assert.IsNotNull(result, "View Result is null");
Assert.IsInstanceOf(typeof(PagedList<Category>), 
    result.ViewData.Model, "Wrong ViewModel");
var categories = result.ViewData.Model as PagedList<Category>;
Assert.AreEqual(3, categories.Count,"Got wrong number of Categories");
Assert.AreEqual(0, (int)categories.PageIndex,"Wrong page Index");
Assert.AreEqual(1, (int)categories.PageNumber,"Wrong  page Number");
}

The Unit Test class decorated with TextFixure attribute which specify that it is unit test class. The test attribute is an indication that it is a test method. The method with Setup attribute will call before execute every test method. This method is using for initialization purpose. If you have five test methods, it will call five times. In the above test, I have used mock objects. Mock objects are simulated objects that can mimic the behaviour of real objects. This is very useful when real object is impractical to incorporate into a unit test such as you don't want to hit the database. In this case, I don't want to hit the database. Instead, I created three fake category objects and setup that returns this fake category objects when there is a call for GetCategories method of the Categoryrepository object.

_repository.Setup(x => x.GetCategories()).Returns(fakeCategories);

The Mock<ICategoryRepository> contains the methods for the behaviour of Mock repository and the repository.Object reperesent the actual repository object. For mocking, I am using the Moq framework. You can download Moq framework from http://code.google.com/p/moq.

The Assert class is using for verfying the results. The test verify the following behaviour with the three fake category objects

The ViewResult should not be null.
The ViewResult should be an instance of PagedList<Category> that supports paging.
The category count should be 3.
The page index should be 0 and page number should be 1.

When running the unit test, it will fail becuase we have not written any code for List Action method.

The below shows fail status (Red Signal) from NUnit GUI test runner.

In the next step (Green stage), we have to write the code to pass the test. The below is the List action method written for pass the test.

[AcceptVerbs(HttpVerbs.Get)]
 public ActionResult List(int? page)
  {
    int pageSize = Convert.ToInt32(
    ConfigurationManager.AppSettings["pagesize"]);
    var categories = _categoryService.GetCategories().
     ToPagedList<Category>(page ?? 0, pageSize);
    return View(categories);
  }

When running the test again, it will pass becuase we have written necessary code to pass the test. In the last stage of TDD is refactor where you will be writing code to improve the overall architcture of the application. In this stage, you can write code confidently because your code is covered by unit tests.

In the next step, you will be writing more unit tests for new identified requirements and behaviours. The below unit test is for the following behaviours while creating a new category.

The category name should be required. If name is empty, an error message should be set into model state.
After creating a new category, it would be redirect to List action method.

[Test]
public void Category_New()
{
  // Arrange     
  CategoryController controller = new CategoryController(_service);
  var category = new Category
  { Name = "Test", Description = "TestDescription" };
  // Act
  var result = (RedirectToRouteResult)controller.Save(category);
  // Assert
  Assert.AreEqual("List", result.RouteValues["action"]);
}
[Test]
public void Category_Name_Required()
{
 // Arrange            
  CategoryController controller = new CategoryController(_service);
  // Act
  Category category = new Category();
  category.Name = String.Empty;
  var result = (ViewResult)controller.Save(category);
  // Assert
 var error = result.ViewData.ModelState["Name"].Errors[0];
 Assert.AreEqual("Name is required.", error.ErrorMessage);
}

The below is the implementation code for the above tests.

[AcceptVerbs(HttpVerbs.Post)]
 public ActionResult Save(Category category)
 {
   //Validations
   EnsureValidations(category);
   if(!ModelState.IsValid)
    {
       return View("SaveCategory");
    }           
  _categoryService.Save(category);
  return RedirectToAction("List");
   }        
private void EnsureValidations(Category category)
{
  if (string.IsNullOrEmpty(category.Name))
  {
   ModelState.AddModelError("Name", "Name is required.");
  }
}

The below shows success status (Green Signal) from NUnit GUI test runner.

Applying Dependency Injection

In this application, I am using Dependency Injection pattern that making the application more loosely coupled and it improves the testability of the application. If you are not familiar with Dependency Injection and Inversion of Control (IoC), I recommend to read Martin Fowler’s article Inversion of Control Containers and the Dependency Injection pattern. Please check my blog post ASP.NET MVC Tip: Dependency Injection with Unity Application Block that demonstrated how you can use the Unity Application Block to perform Dependency Injection within an ASP.NET MVC application.

public static void ConfigureUnityContainer() {
IUnityContainer container = new UnityContainer();
// Registrations
container.RegisterType<DBData , DBData>
    (new HttpContextLifetimeManager<DBData>());
container.RegisterType<ICategoryRepository, CategoryRepository>
    (new HttpContextLifetimeManager<ICategoryRepository>());
container.RegisterType<ICategoryService, CategoryService>
    (new HttpContextLifetimeManager<ICategoryService>());
ControllerBuilder.Current.SetControllerFactory(
  new UnityControllerFactory(container));           
}

The above code setup the dependencies with Unity Application block and configure the controller factory with Unity.

Summary

In this post, I demonstrated how to build Test-Driven Development (TDD) applications with Microsoft ASP.NET MVC. ASP.NET MVC is an excellent framework for building TDD based applications with highly loosely coupled manner.

You can download the source code from here.

T4 Template for generate Table Script from XSD

shiju — Fri, 10 Jul 2009 05:48:00 GMT

The below T4 template will generate Create Table script from a XSD file. The Template will create a dataset from a XSD file and generate create table script from the dataset.

    1 <#@ template language="C#v3.5" hostspecific="True" debug="True" #>
    2 <#@ assembly name="System.Core" #> 
    3 <#@ assembly name="System.Data" #> 
    4 <#@ assembly name="System.Xml" #> 
    5 <#@ output extension=".sql" #>
    6 <#@ import namespace="System" #> 
    7 <#@ import namespace="System.IO" #> 
    8 <#@ import namespace="System.Xml" #> 
    9 <#@ import namespace="System.Data" #> 
   10 <#PrepareToRender(); #>
   11 <#
   12 foreach (DataTable dt in ds.Tables) {
   13     tableName= dt.ToString();
   14 #>    
   15 CREATE TABLE <#= tableName #>
   16 (
   17 <#
   18 PushIndent("  ");
   19 foreach (DataColumn dc in dt.Columns) {
   20 WriteLine( dc.ToString() + "  " + MapToSqlType(dc.DataType.Name) + ",");
   21  }
   22  PopIndent();
   23 #>
   24 )
   25 <# 
   26 }
   27 #>
   28 <#+
   29 DataSet ds;
   30 string tableName;
   31 void PrepareToRender()
   32 {
   33 ds = new System.Data.DataSet();
   34 //Load the XSD
   35 ds.ReadXmlSchema("Metadata.xsd");
   36 }
   37 string MapToSqlType(string clrType)
   38 {
   39   switch(clrType)
   40   {
   41   case "String":
   42   return "Varchar(50)";   
   43   case "Int32":
   44   return "int";
   45   //Do other mapings
   46   default:  
   47   return clrType;
   48   }
   49 }
   50 #>

Mini TechEd in Trivandrum

shiju — Mon, 15 Jun 2009 07:52:00 GMT

Kerala Microsoft user’s group (K-MUG) is organizing a Mini-TechEd in Trivandrum, India. Don’t miss this Free opportunity to learn about Windows 7, Visual Studio 2010 features, WPF, What is new in ASP.NET 4.0, SQL server best practices,SQL logical query execution and optimization tips,Hidden Gems in SQL Server.

Date : 27th June 2009

Venue : Technopark, Trivandrum

Register Now!

Using .Net 3.5 and C# 3.0 features in T4 templates

shiju — Wed, 03 Jun 2009 12:12:00 GMT

The T4 templates are compiled against .Net Framework 2.0 by default and it will be restricted to use LINQ and other .Net 3.5 features in your T4 templates. If you want to use any of C# 3.0 or .Net 3.5 features in your T4 templates, you have to specify T4 templates language attribute is C#v3.5 instead of C#. The .Net 3.5 features are using System.Core namespace so that you have to give reference to System.Core namespace in the T4 templates.

The below is the syntax

    1 <#@ template language="C#v3.5" hostspecific="True" #>
    2 <#@ assembly name="System.Core" #> 

Applying Dependency Injection in ASP.NET MVC NerdDinner.com Application

shiju — Thu, 12 Mar 2009 10:33:00 GMT

ScottGu, Scott, Phil and Rob have announced a free ASP.NET MVC eBook and an open source ASP.NET MVC application Nerddinner.com. The free eBook is a single chapter of the Wrox’s upcoming title Professional ASP.NET MVC 1.0. The free eBook provides an end-to-end walkthrough of building NerdDinner.com application. The free eBook and the free Nerddinner application are extremely useful if anyone is trying to lean ASP.NET MVC. If you are a beginner to ASP.NET MVC, I highly recommend checking the eBook and the NerdDinner.com application. You can download the NerdDinner.com application from here.

In this post, I am applying Dependency Injection to the NerdDinner.com application using Microsoft Unity Application Block. I was looking through the NerdDinner code and observed that controllers have Dependency Injection enabled constructors. So I can apply Dependency Injection through constructor injection without change any existing code. A Dependency Injection framework injects the dependencies into a class when the dependencies are needed. Dependency Injection enables looser coupling between classes and their dependencies and provides better testability of an application and it removes the need for clients to know about their dependencies and how to create them. If you are not familiar with Dependency Injection and Inversion of Control (IoC), read Martin Fowler’s article Inversion of Control Containers and the Dependency Injection pattern. In this post, I am using Microsoft Unity Application Block for performing Dependency Injection pattern. Please check my blog post ASP.NET MVC Tip: Dependency Injection with Unity Application Block that demonstrated how you can use the Unity Application Block to perform Dependency Injection within an ASP.NET MVC application.

In this demo, I am doing constructor injection using Unity container. If a class instantiate using the Resolve method of the Unity container has a constructor that defines one or more dependencies on other classes, the Unity container automatically creates the dependent object instance specified in parameters of the constructor

Controller constructors and dependencies of NerdDinner application

Listing 1 – Constructor of DinnersController

   41  public DinnersController(IDinnerRepository repository) {
   42             dinnerRepository = repository;
   43         }

Listing 2 – Constrcutor of AccountController

   26  public AccountController(IFormsAuthentication formsAuth, IMembershipService service) {
   27             FormsAuth = formsAuth ?? new FormsAuthenticationService();
   28             MembershipService = service ?? new AccountMembershipService();
   29         }

Listing 3 – Constructor of AccountMembership – Concrete class of IMembershipService

  271 
  272         public AccountMembershipService(MembershipProvider provider) {
  273             _provider = provider ?? Membership.Provider;
  274         }

Dependencies of NerdDinner

DinnersController, RSVPController and SearchController have a dependency with IDinnerRepositiry. The concrete implementation of IDinnerRepositiry is DinnerRepositiry. AccountController has dependencies with IFormsAuthentication and IMembershipService. The concrete implementation of IFormsAuthentication is FormsAuthenticationService and the concrete implementation of IMembershipService is AccountMembershipService. The AccountMembershipService has a dependency with ASP.NET Membership Provider.

The below steps will configure Unity to perform constructor injection in NerdDinner application.

Step 1 – Add reference for Unity Application Block

Add a reference to Microsoft.Practices.Unity.dll and Microsoft.Practices.ObjectBuilder2.
You can download Unity from here. The Unity project is available in CodePlex at http://www.codeplex.com/unity.

Step 2 – Custom LifetimeManager class

Unity provides the functionality to specify the location of instance. This functionality is very useful for the ASP.NET applications where we can store or cache the container in the HttpContext, HttpSession or HttpApplication. In this demo, I used to store the container in current HttpContext. In the below code, I am creating a custom lifetime manager to store container in the current HttpContext.

    1 using System;
    2 using System.Web;
    3 using Microsoft.Practices.Unity;
    4 
    5 namespace NerdDinner.IoC {
    6     public class HttpContextLifetimeManager<T> : LifetimeManager, IDisposable {
    7         public override object GetValue() {
    8             return HttpContext.Current.Items[typeof(T).AssemblyQualifiedName];
    9         }
   10         public override void RemoveValue() {
   11             HttpContext.Current.Items.Remove(typeof(T).AssemblyQualifiedName);
   12         }
   13         public override void SetValue(object newValue) {
   14             HttpContext.Current.Items[typeof(T).AssemblyQualifiedName] = newValue;
   15         }
   16         public void Dispose() {
   17             RemoveValue();
   18         }
   19     }
   20 }

Step 3 – Controller Factory for Unity and Register Types for Injection

    1 using System;
    2 using System.Collections.Generic;
    3 using System.Linq;
    4 using System.Web;
    5 using System.Web.Mvc;
    6 using System.Web.Security;
    7 using System.Security.Principal;
    8 using NerdDinner.Models;
    9 using Microsoft.Practices.Unity;
   10 using NerdDinner.Controllers;
   11 namespace NerdDinner.IoC {
   12     public class UnityControllerFactory : DefaultControllerFactory
   13     {
   14         IUnityContainer container;
   15 
   16         public UnityControllerFactory(IUnityContainer container)
   17         {
   18             this.container = container;
   19         }
   20 
   21         protected override IController GetControllerInstance(Type controllerType)
   22         {
   23             try {
   24                 if (controllerType == null)
   25                     throw new ArgumentNullException("controllerType");
   26 
   27                 if (!typeof(IController).IsAssignableFrom(controllerType))
   28                     throw new ArgumentException(string.Format(
   29                         "Type requested is not a controller: {0}", controllerType.Name),
   30                         "controllerType");
   31                 return container.Resolve(controllerType) as IController;
   32             }
   33             catch { return null; }
   34 
   35         }
   36         public static void Configure() {
   37             //create new instance of Unity Container
   38             IUnityContainer container = new UnityContainer();
   39             //Register dependencies
   40             container.RegisterType<IFormsAuthentication, FormsAuthenticationService>();
   41             container.RegisterType<IMembershipService,AccountMembershipService>();
   42             container.RegisterInstance<MembershipProvider>(Membership.Provider);
   43 
   44             //Inject DinnerRepository for contract IDinnerRepository
   45             container.RegisterType<IDinnerRepository, 
   46                 DinnerRepository>(new HttpContextLifetimeManager<IDinnerRepository>());
   47             ControllerBuilder.Current.SetControllerFactory(
   48                 new UnityControllerFactory(container));
   49         }
   50     }
   51 }

The controller factory is responsible for creating controller instances.We extend the built in default controller factory with our own factory for working Unity with ASP.NET MVC.

The above Unity configuration specified in the Configure method tells that, to inject instance of DinnerRepositiry when there is a request for IDinnerRepositiry and inject instance of FormsAuthenticationService when there is a request for IFormsAuthentication and inject instance of AccountMembershipService when there is a request for IMembershipService. The AccountMembershipService class has a dependency with ASP.NET Membership provider. So we configure that inject the instance of Membership Provider.

Step 4 – Modify Global.asax.cs for configure Unity container

   29  void Application_Start() {
   30             RegisterRoutes(RouteTable.Routes);
   31             UnityControllerFactory.Configure();
   32         }

The above code will set the configuration for the Unity container when our ASP.NET MVC application is started.

The source code of the new added files can be download from here

ASP.NET MVC Tip: Add a new T4 template for making MVCContrib Grid Helper Component

shiju — Wed, 04 Mar 2009 05:20:00 GMT

In this tip, I demonstrate how you can add a T4 scaffolding template within the “Add View” dialog of the ASP.NET MVC Framework. I am creating a List scaffolding template for MVCContrib Grid helper component. Earlier, I have blogged about how to use MVCContrib Grid helper component but recently the component has changed a lot and introducing a fluent interface that provides a cleaner and more discoverable API. You can read all details from Jeremy Skinner's blog about the new enhancements of MVCContrib Grid helper component. I am creating the T4 template against the latest trunk of MVCContrib Grid helper.

Overriding default T4 templates of ASP.NET MVC

The default behaviour of T4 templates available in the “AddController” and “AddView” dialog is machine-level. You can override the default T4 templates of ASP.NET MVC framework at per project level and also able to add additional templates within the “Add Controller” and “Add View” dialog. if you want override the global T4 tempates at project level, just copy the C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\ItemTemplates\CSharp\Web\MVC\CodeTemplates” folder into your ASP.NET MVC project. When you add T4 templates at project level, you should set the “Custom Tool” property of each of the T4 template files to an empty string value. Otherwise Visual Studio will try to transform the template so that you will get an error. The CodeTemplates folder contains two subfolders AddController and AddView and you can add new templates into this folders. If you add a new T4 template under the AddView folder, the new template will show in the "Add View" dialog. In this demo, I am adding a new template named MvcContribList.tt. For adding a new template within the Visual Studio, just add a text file and rename it with .tt extension.

The Add View dialog shows the new added template MvcContribList in the View content list.

I have taken the default List.tt template and modified it for creating the new template for working with MVCContrib Grid helper component. I have added the below code to working with MVCContrib Grid helper.

   59 <%= Html.Grid< <#= mvcHost.ViewDataType #> >(Model).Columns(column => {
   60  <#
   61     foreach(string propertyName in properties) {
   62  #> 
   63 column.For(x => x. <#= propertyName #> ); <# } #>
   64 column.For(x => Html.ActionLink("Edit", "Edit", new { id = x.ID })).DoNotEncode();
   65 column.For(x => Html.ActionLink("Delete", "Delete", new { id = x.ID })).DoNotEncode();   
   66 })    
   67 .Attributes(style => "width:100%")
   68 .Empty("There are no records")
   69   %>
   70   <p>
   71     <%= Html.ActionLink("Create New", "Create") %>
   72    </p>
   73 <#
   74 }
   75 #>

The source code along with a sample project available from here

Summary

In this tip, I demonstrated how to customizing and adding T4 templates and created a new T4 template for working with MVCContrib Grid helper component. You can easily override the global T4 templates of ASP.NET MVC framework and also able to add additional templates within the “Add Controller” and “Add View” dialog.

ASP.NET MVC 1.0 Release Candidate (RC) Released

shiju — Wed, 28 Jan 2009 02:51:24 GMT

After 5 CTP versions and 1 Beta version, Microsoft has finally shipped Release Candidate version of ASP.NET MVC 1.0. You can download the RC version from here. One of the new features of ASP.NET MVC 1.0. is the scaffoldig support using Visual Studio's built-in T4. You can read full details from Scott Guthrie's blog post ASP.NET MVC 1.0 Release Candidate Now Available.

Below are the some of my existing blog posts about ASP.NET MVC.

ASP.net MVC Vs ASP.net Web Form

ASP.NET MVC Grid View using MVCContrib

ASP.NET MVC Tip: Ajax and Validations using jQuery

ASP.NET MVC Tip: Dependency Injection with StructureMap

ASP.NET MVC Tip: Dependency Injection with Unity Application Block

Secure ASP.NET MVC Applications

I Became Father

shiju — Mon, 19 Jan 2009 23:43:00 GMT

Tuesday, the 13th of January 2009, was the most memorable day in my life. I became a father for the first-time! My wife Rosmi and I were blessed with a baby girl. The name of the baby is Irene Rose Shiju. Both Rosmi and Irene are doing great.

Irene Rose - Our little angel

xVal - An excellent validation framework for ASP.NET MVC

shiju — Mon, 12 Jan 2009 12:28:00 GMT

Steve Sanderson has developed an excellent validation framework for ASP.NET MVC. His validation framework xVal is an open-source project hosted on CodePlex. You can read more details from his blog post xVal - a validation framework for ASP.NET MVC

Secure ASP.NET MVC Applications

shiju — Fri, 19 Dec 2008 03:02:00 GMT

One of the greatest advantages of ASP.NET MVC is that it provides a "Close to the Metal" programming experience and you have full control over the HTML. It aslo means that you should care about the vulnerabilities regards with your HTML. In webform, server controls would be automatically HTML-encoded their outputs. While developing ASP.NET MVC apllications, you should filter your HTML to avoid XSS attacks. Use the following HTML helper methods to avoid vulnerabilities in your ASP.NET MVC applications.

Use Html.Encode to defense XSS

Use Html.Encode Helper method if you output user-supplied data.

Your search result for category : <%=Html.Encode(ViewData["Category"]) %>

Lets assume that if the user supplied "<script>alert('XSS')</script>" for input data , the Html.Encode will avoid to execute as a JavaScript function and will ensures to display that string as a literal text. When you using built-in Helper methods, It will automatically HTML-encode their outputs. As Rob Conery said, Html.Encode is not a silver bullet to avoid XSS

Use Html.AntiForgeryToken to defense Cross-Site Request Forgery (CSRF)

The Html.AntiForgeryToken helper method provides the support for detecting and defense CSRF attacks. This helper method available in Microsft ASP.NET MVC Futures assembly (Microsoft.Web.Mvc.dll). The assembly can download from http://www.codeplex.com/aspnet/Release/ProjectReleases.aspx?ReleaseId=18459 . Check the below example

<% Html.BeginForm("Save", "Category", FormMethod.Post); %>
<%= Html.AntiForgeryToken() %>

<% Html.EndForm(); %>

The AntiForgeryToken helper would generate a hiiden field named __MVC_AntiForgeryToken and gave a value that randomly generated for each user request. And at the same it gave cookie with name __MVC_AntiForgeryToken and the value would be constant for user session.

<form method="post" action="/Category/Save">
<input type="hidden" value="34/LV6nApPw0VWjxZkwY1imE8U8c+fAthll+ssF1fhbbK20HYA1EzXB6xaHqCHo4" name="__MVC_AntiForgeryToken"/>
</form>

The authorization filter atrribute [ValidateAntiForgeryToken] will check the all incoming request with form value __MVC_AntiForgeryToken and block the request if there is a invalid token is supplied. A CSRF attacker can't know the randomly generated value of AntiForgeryToken.

The below example used [ValidateAntiForgeryToken] in the controller action to validate the AntiForgeryToken.

[ValidateAntiForgeryToken]
public ActionResult Save(FormCollection form) {
}

My UG Talk on ASP.NET MVC

shiju — Tue, 16 Dec 2008 01:32:00 GMT

I did an another UG presentation on the ASP.NET MVC Framework for K-Mug (Kerala Microsoft User Group) at Technopark, India. You can download the presentation material from here

UG Session on ASP.NET MVC

shiju — Mon, 17 Nov 2008 01:16:00 GMT

Last saturday, I did a presentation on the ASP.NET MVC framework for K-Mug (Kerala Microsoft User Group, India). This was an introduction talk on ASP.NET MVC. You can download the presentation from here.

ASP.NET MVC Tip: Dependency Injection with Unity Application Block

shiju — Fri, 24 Oct 2008 12:26:00 GMT

In my earlier post, I have explained how to use dependency injection pattern in ASP.net MVC application using StructureMap. In this post, I demonstrate how you can use dependency injection pattern using Microsoft’s Unity Application Block (Unity). If you want to develop an ASP.NET MVC application fully with Microsoft stack, you can use Unity Application Block to perform dependency injection.Unity is a cool dependency injection container and I hope that it will become more powerful in the future releases.

Introduction to Unity

Unity is a lightweight, extensible dependency injection container that provides the support for constructor, property, and method call injection. Unity has a service location capability that allows the ASP.NET developer to store or cache the container in the ASP.NET session, application or per Request.

Register Dependencies

Unity provides two methods for registering types and mappings with the container. The RegisterType method registers a type with the container and the RegisterInstance method registers with the container an existing instance of a type.

IUnityContainer container = new UnityContainer();            
container.RegisterType<ICategoryRepository, CategoryRepository>();

The above code tells the Unity Container that, to inject the instance of CategoryRepository when there is a request for ICategoryRepository and the container will create a new instance of CategoryRepository every time when there is request for ICategoryRepository. The default behavior is for the container to use a transient lifetime manager and the container will not store or cache a reference to the object. If you want singleton behavior for objects, you have to register a LifetimeManager. A lifetime manager controls how stores references to object instances and reused within the container.

IUnityContainer container = new UnityContainer();
    container.RegisterType<ICategoryRepository,
       CategoryRepository>(new ContainerControlledLifetimeManager());

The above registration specify that any time an instance of ICategoryRepository is requested, you will get back the same instance of CategoryRepository as long as the container is alive. The container will create a new instance at the time of first request and will be use the same instance for the later requests. The ContainerControlledLifeTimeManager class provides the singleton behavior for the container.

You can create your own custom LifetimeManager class derive from LifetimeManager class. The important methods of LifetimeManager class are GetValue that returns the instance, SetValue method store the instance value and RemoveValue method reomove the instance from the container.

public abstract class LifetimeManager : ILifetimePolicy
{
    public abstract object GetValue();
    public abstract void SetValue(object newValue);
    public abstract void RemoveValue();
}

Use Unity with an ASP.NET MVC application

In this tip, I show how you can use the Unity Application Block to perform Dependency Injection within an ASP.NET MVC application. In this tip, I will show you how to perform constructor injection. Constructor Injection will push dependencies into a concrete class through constructor arguments.

The below code listings show that a controller class and its dependent classes.

Listing 1 – CategoryController

public class CategoryController : Controller {
       ICategoryService _categoryService = null;

        //Inject instance of CategoryService using construction injection
        public CategoryController(ICategoryService categoryService) {
            _categoryService = categoryService;
        }
        /// <summary>
        /// 
        /// </summary>
        /// <param name="page"></param>
        /// <returns></returns>
        [AcceptVerbs(HttpVerbs.Get)]
        public ActionResult List(int? page) {
            var categories = _categoryService.GetCategories(page ?? 0, 10);
            return View(categories);
        }
    }

Listing 2 – ICategoryService

 public interface ICategoryService {
    PagedList<Category> GetCategories(int pageIndex,int pageSize); 
    }

Listing 3 – CategoryService

  public class CategoryService : ICategoryService  {
         ICategoryRepository _repository = null;
        /// <summary>
         /// Creates a CategoryService based on the passed-in repository
        /// </summary>
         /// <param name="repository">An ICategoryRepository</param>
     public CategoryService(ICategoryRepository repository) {
            _repository = repository;
        if (_repository == null)
           throw new 
                 InvalidOperationException("Repository cannot be null");
        }

    public PagedList<Category> GetCategories(int pageIndex,int pageSize) { 
       return _repository.GetCategories().
         ToPagedList<Category>(pageIndex, pageSize); 
        }
    }

Listing 4 – ICategoryRepository

public interface ICategoryRepository {
        IQueryable<Category> GetCategories();       
    }

Listing 5 – CategoryRepository

public class CategoryRepository : ICategoryRepository  {

       myFinanceData _db;
        public CategoryRepository(myFinanceData data) {            
            _db = data;
            
        }

        /// <summary>
        /// Linq To Sql implementation for Categories
        /// </summary>
        /// <returns>IQueryable of Categories</returns>
        public IQueryable<Category> GetCategories() {

            return from c in _db.DataContext.Categories
                   select new Category {
                       ID=c.ID,
                       Name=c.Name,
                       Description=c.Description,
                       CategoryType = c.CategoryType
                   };

        }
   }

Listing 6 – myFinanceData

public  class myFinanceData
    {
        private myFinanceDataContext dataContext;

        public myFinanceDataContext DataContext {
            get {
                if (dataContext == null) {
                    dataContext = new myFinanceDataContext();
                }

                return dataContext;
            }
        }
    }

Depedencies

The CategoryController has a dependency with ICategoryService. The concrete implementation of ICategoryService, i.e. CategoryService has a dependency with ICategoryRepository. The concrete implementation of ICategoryRepository, i.e. CategoryRepository has a dependency with myFinanceData. When we calling action methods of Category controller, we need to create objects of CategoryService, CategoryRepository and myFinanceData.

The below steps will configure Unity to perform constructor injection in our ASP.NET MVC application.

Step 1 – Add reference for Unity Application Block

Add a reference to Microsoft.Practices.Unity.dll and Microsoft.Practices.ObjectBuilder2.

You can download Unity from http://www.codeplex.com/unity

Step 2 – Custom LifetimeManager class

Unity provides the functionality to specify the location of instance. This functionality is very useful for the ASP.NET applications where we can store or cache the container in the HttpContext, HttpSession or HttpApplication. In this tip, I used to store the container in current HttpContext. In the below code, I am creating a custom lifetime manager to store container in the current HttpContext.

public class HttpContextLifetimeManager<T> : LifetimeManager, IDisposable {
        public override object GetValue() {
            return HttpContext.Current.Items[typeof(T).AssemblyQualifiedName];
        }
        public override void RemoveValue() {
            HttpContext.Current.Items.Remove(typeof(T).AssemblyQualifiedName);
        }
        public override void SetValue(object newValue) {
            HttpContext.Current.Items[typeof(T).AssemblyQualifiedName]
                = newValue;
        }
        public void Dispose() {
            RemoveValue();
        }

Step 3 – Controller Factory for Unity

public class UnityControllerFactory : DefaultControllerFactory
{
    IUnityContainer container;

    public UnityControllerFactory(IUnityContainer container)
    {
        this.container = container;
    }

    protected override IController GetControllerInstance(Type controllerType)
    {
        try {
            if (controllerType == null)
                throw new ArgumentNullException("controllerType");

            if (!typeof(IController).IsAssignableFrom(controllerType))
                throw new ArgumentException(string.Format(
                    "Type requested is not a controller: {0}",
                    controllerType.Name),
                    "controllerType");
            return container.Resolve(controllerType) as IController;
        }
        catch { return null; }

    }
 }

The controller factory is responsible for creating controller instances.We extend the built in default controller factory with our own factory for working Unity with ASP.NET MVC.

Step 4 – Register Types and Set Controller Factory

public static class Bootstrapper {

    public static void ConfigureStructureMap() {

        StructureMap.StructureMapConfiguration.AddRegistry(new DBServiceRegistry());
        StructureMap.StructureMapConfiguration.AddRegistry(new DInjRegistry());


        IUnityContainer container = new UnityContainer();
        container.RegisterType<ICategoryRepository,
        CategoryRepository>(new ContainerControlledLifetimeManager());
    }
    public static void ConfigureUnityContainer() {
        IUnityContainer container = new UnityContainer();
        // Registrations
        container.RegisterType<myFinanceData, myFinanceData>
            (new HttpContextLifetimeManager<myFinanceData>());
        container.RegisterType<ICategoryRepository, CategoryRepository>
            (new HttpContextLifetimeManager<ICategoryRepository>());
        container.RegisterType<ICategoryService, CategoryService>
            (new HttpContextLifetimeManager<ICategoryService>());
        ControllerBuilder.Current.SetControllerFactory(
            new myFinance.Web.Controllers.UnityControllerFactory(container));           
    }
}

The above Unity configuration specified in the ConfigureUnityContainer method, tells to inject CategoryService when there is a request for ICategoryService. And also inject CategoryRepository when there is a request for ICategoryRepository. The CategoryRepository class has a dependency with myFinanceData. So we configure that inject the instance of myFinanceData when there is request for myFinanceData. The above code also set the controller factory for working with Unity.

Step 5 – Modify Global.asax.cs for configure Unity container

 protected void Application_Start() {
            RegisterRoutes(RouteTable.Routes);            
            //Configure for Dependecny Injection using Unity
            Bootstrapper.ConfigureUnityContainer();           
            
        }

The above code will set the configuration for the Unity container when our ASP.NET MVC application is started. The Bootstrapper class is specified in the Step 4.

Summary

In this tip, I demonstrated how you can use the Unity Application Block to perform Dependency Injection within an ASP.NET MVC application. The Unity Application Block allows us to develop highly loosely coupled ASP.NET MVC applications using fully with Microsoft stack.

ASP.NET MVC for Live Applications

shiju — Mon, 20 Oct 2008 08:22:00 GMT

ASP.NET MVC has got big attention in the community and lot of people are looking to develop production ready applications with ASP.NET MVC. When can we start production ready applications with ASP.NET MVC? Since ASP.NET MVC Beta version is available, I think this is time to start live application with ASP.NET MVC. There is already lot of live applications build with ASP.NET MVC. Stackoverflow is really a killer web application build with ASP.NET MVC. If you are an Architect, this is the right time to develop infrastructure frameworks for ASP.NET MVC. The RTM version will be in Q4 2008 or Q1 2009. I hope that the RTM version will be release on this December. The changes from Beta to RTM version will be very minimum and the Beta release comes with an explicit "go-live" license that allows you to deploy it in production environments. Scott Guthrie wrote in his bog post ASP.NET MVC Beta Released “Today's ASP.NET MVC Beta release comes with an explicit "go-live" license that allows you to deploy it in production environments. The previous preview releases also allowed go-live deployments, but did so by not denying permission to deploy as opposed to explicitly granting it (which was a common source of confusion). Today's release is clearer about this in the license. The beta release is getting close to V1 feature complete, although there are still a few more features that will be added before the final "V1" release (including several VS tooling enhancements). The team decided to call this release a "beta", though, because the quality and testing of it is higher than the previous previews (a lot of bug fixes and performance tuning work went into it), and they feel that the core features that are in it are now "baked enough" that there won't be major changes from this release to the final product”.

I believe that breaking changes and new features will be available after the release of V1. When I asked about the SubController infrastructure, Scott Guthrie replied that “The team currently has that penciled in for the release immediately following V1. The reason for not having it in V1 are: 1) there are a couple of approaches that could be used for it, and we want to spend a little more time investigating and exploring them (and not bake something prematurely into V1), and 2) there is a subcontroller implementation currently in the MVCContrib project that be used with the V1 release. I'd recommend looking at using that one if you need a subcontroller pattern, and then we'll bake one into the core binary once we feel confident on a final design”.

Our Development Attitude

ASP.NET MVC is a great technology and you can build powerful and highly maintainable web applications with ASP.NET MVC. But please keep in mind that you can build good and bad applications with same technology. So our attitude and development approaches are very important for building great software and the most important things is that we should have a good architecture for good software. I strongly believe that the .Net developer community should be more focus on object oriented principles and practices. I believe that the ALT.NET movement is a good sign and the ALT.NET Criterion is good for building better software. The ASP.NET MVC technology is based on a loosely coupled architecture and the framework is highly testable so that it enables to build great software. When we build applications with ASP.NET MVC, we should focus on object-oriented principles and practices and take this time to change our attitude towards object-oriented way. In the past, applications have been data-centric and this has been gradually changing to object-oriented way. I would like to suggest using an ORM for data persistence, Persistence Ignorance (PI) objects for domain layer, Repository pattern, Inversion of Control (IoC) container for dependency injection (DI) along with your ASP.NET MVC application. And I believe that Test Driven Development (TDD) gives you lot of values to your application development process.

Learning Resources to start applications

Stephen Walther’s blog post A Guide to Learning ASP.NET MVC Beta 1 contains lot of links that provides to learn and develop applications with ASP.NET MVC. For validations, Emad Ibrahim’s blog post Client & Server Side Validation in ASP.NET MVC is an excellent one. For dependency injection, my blog post ASP.NET MVC Tip: Dependency Injection with StructureMap provides step by step instructions to apply dependency injection into an ASP.NET MVC application using Structuremap. My blog post ASP.NET MVC Tip: Ajax and Validations using jQuery demonstrates how we can use jQuery for Ajax and validation as well as demonstrating partial rendering using user control. Steve Sanderson's ( Author of Apress' ASP.NET MVC Book) Blog is damn worth to read. And I strongly recommend to visit Rob Conery’s blog for his storefront series. He has been building an entire ecommerce application with ASP.NET MVC