Learning

I feel so behind sometimes

Sean Lynch — Tue, 18 Dec 2007 13:22:41 GMT

I was trying to determine the best way to secure my admin* actions when I thought of something I had only really seen while studying for my MCSD.Net exams, or maybe it was the MCPD upgrade exams I haven't gotten round to taking.

I decided to secure the admin controller actions using.

[PrincipalPermission(SecurityAction.Demand,Role="<Role>")]

Which I had never used even though I started programming .Net in during the beta of 1.0. And I have to admit that each time I run into something like this, it makes me feel that my thought in a previous post is right.

This works for my immediate needs, after thinking about it, it would be nice if the Route Validation could deal with security too. That way instead of getting "Security Exception" when navigating to one of the admin actions, the route would simply not resolve resulting in "An action named 'New could not be found on the controller." if someone was trying out the obvious Urls for maintenance, since they are rather hackable (from Phil Haack's recent interview on the ASP.Net Podcast show ).

Though now that I write that I think it would be better to have it throw the Security Exception, log it, then handle both errors be handle it as a 404 error from then on. That way I can log information of the unauthorized attempts on the admin actions, without telling the outside world anything. So maybe I don't need to be able to specify authentication validation on the routes after all. Though routes based on errors might be nice.

Now I just need to look up more on custom error pages.

I really do feel so behind sometimes.

* Will be making a post in next few days on this. The dynamic stuff I had started for the last post was a bit more usable in the admin area.

Technorati Tags: aspnetmvc, Security

Login via Usercontrol View + jQuery

Sean Lynch — Fri, 14 Dec 2007 12:16:51 GMT

Since administration was the next part I wanted to work on.

I decided that for the moment I just want a little login for in the upper corner like

I decided to put the login screen view logic into a user control, and added the following user control named Login.ascx and placed it into the Shared

<%@ Control Language="C#" Inherits="System.Web.Mvc.ViewUserControl" %>

<%if(!Page.User.Identity.IsAuthenticated) {%>
    <form action="/Home/Login" method="post" id="LoginForm">
        <span id="EmailLabel">Username:</span><br />
        <%=Html.TextBox("Username")%><br />
        <span id="PasswordLabel">Password:</span><br />
        <%=Html.Password("Password")%><br />
         <span id="Error">
            <%=ViewData.ContainsDataItem("Message") ? ViewData["Message"] + 
               "<BR />" : ""%>
        </span>
        <%=Html.SubmitButton("Submit", "Login")%>
    </form>
<%}else {%>
        <span>Not <%=Page.User.Identity.Name %><br />    
        <%=Html.ActionLink<DevExamples.Controllers.HomeController>(c => c.Logout()
            , "Logout", new { id = "LogoutLink" })%></span>

<%} %>

And added the user control to the masterpage using

<div id="Login"><%=Html.RenderUserControl("~/Views/Shared/Login.ascx") %><div>

I was going to use

using (Html.Form<DevExamples.Controllers.HomeController>(c=>c.Login()
   ,System.Web.Mvc.FormExtensions.FormMethod.post,new {id="LoginForm"}))

to create the form (because it is a lot cooler), but couldn't get the html attributes to work and was more interested in getting the dynamic stuff working then looking at the code for the extension method in the MVCToolKit, in other words being lazy.

I thought about putting the authentication checking logic into the controller. But handling it this way made it a bit simpler, and more self contained, so until I find a compelling enough reason I will be leaving it this way.

After I had the user control showing up, I decided to hook up the actual authentication. I decided to go with forms authentication, and set it up using the button in the solution explorer.

Next it was time to create the login and logout controller actions, which I decided would best fit in the HomeController, At first I had thought to create two separate views, one for when logged in and one for logged out, then remembered Phil Haack, at least I think it was him, something about being able to use user controls in the RenderView method of the controller.

I ended up with the following two controller actions:

[ControllerAction]
public void Login()
{
    if (!ControllerContext.HttpContext.User.Identity.IsAuthenticated)
    {
        if (Request.RequestType == "POST")
        {
            string userName = Request.Form["Username"];
            string password = Request.Form["Password"];

            if (Membership.ValidateUser(userName, password))
            {
                FormsAuthentication.SetAuthCookie(userName, true);
                //Set cookie and redirect
                RedirectToAction("Login");
            }
            else
            {
                ViewData.Add("Message", "Invalid Username/Password");
            }
        }
    }
    RenderView("Login");
}
[ControllerAction]
public void Logout()
{
    FormsAuthentication.SignOut();
    RedirectToAction("Login");
}

Since it was allowing me to just render out the user control, I decided there was no point to refreshing the whole page, so decided to use a AJAXish way of doing it. So I decided it was time to pick a javascript library. And since Phil had provided a link to Using script.aculo.us with ASP.NET MVC by Chad Myers,I decided to go with jQuery for this (that and it seemed to fit better).

After a bit of reading through their tutorials I added this to the header section of the master page.

<script src="../../Content/jquery.js" type="text/javascript"></script>
<script src="../../Content/jquery.form.js" type="text/javascript"></script>
<script type="text/javascript">
    var readyFuncs = function() { 
        $('#LoginForm').ajaxForm(function(result) { 
            $('#Login').html(result); 
            $(document).ready(readyFuncs); 
        }); 
        $('#LogoutLink').click(function(){
            $.get('/Home/Logout',function(result){
                $('#Login').html(result);
                $(document).ready(readyFuncs); 
            });
            return false;
        });
    };
    $(document).ready(readyFuncs);
</script>

The only real snag I had run into with this was that each time the Login div was refreshed I had to reregister the events.

Technorati Tags: aspnetmvc, jQuery, FormsAuthentication

I think reading is ruining my job

Sean Lynch — Mon, 03 Sep 2007 12:48:58 GMT

Back in May I decided that I was going to start reading more. Admittedly my dedication to this has been nowhere near what Justice Gray's.

Since that first post I have:

Read 3 and 8/3rds tech related books
Listened to almost every .NET Rocks! (which I had already been listening to for a few years) and many of RunAs Radio shows
Skimming the MSDN main feed for things that looked interesting.
Reading 25 or so mostly development blogs, thankfully Ayende is the only one who averages more then one post per day or I would never get anything done.
Reading through the source of a couple of open source projects I use, and submitted a patch to the Subtext project (hopefully it wasn't crap).

I have learned a lot.

Unfortunately it has been steadily reducing my job satisfaction. While some of it stems from working with a foundation I wrote in .Net 1.0 before having ever actually worked with tiered architecture, and I'm sure that a lot of it is also the "grass is greener on the other side" syndrome, I have been slowly noticing rather important deficiencies in my coding experience.

Chief among them are:

No form of automatic testing or validation. This one probably isn't here for the reason that most people would think, because it improves code quality. Its here because having developers spend a day or two manually retesting a section of the program, rather then spending that day or two automating the testing seems to help Parkinson's Law when there is no impending next task.
Platform backwards compatibility. While I completely understand why we need to still support SQL 2000, and completely agree with it too, it still makes me weep inside a little when I read the features in SQL 2005/8.
Most of what I do has little value elsewhere. Admittedly most of this one is kind of my fault, but I'll plead ignorance as my excuse. My boss is rather adamant that we only use control that we develop, or the comes from Microsoft. And since with .Net 1.0 there was no AJAX support built in, we recreated just about every ASP.Net control again, most inheriting from WebControl (I really wish .Net had multiple inheritance).
No real experience with cross browser support. This one is completely my fault, well 99.95% my boss did have to agree with it. For this one I plead Netscape 4.x and very heavy JavaScript/Dynamic HTML, and now there just is not enough justification to change it.

Now it is a very nice place to work, which combined with a rather intense dislike for job hunting means that I'm not highly likely to try to solve these problems by searching for a new job. Which might be a good thing, since it requires me to improve in areas outside of design/coding.

Hopefully I can avoid becoming the fictional guy who sent Dennis Forbes, and recently talked about on coding horror.

Still not sure, but it can be learned

Sean Lynch — Wed, 29 Aug 2007 11:54:10 GMT

I doubt I actually had anything direct to do with it but something seems to have clicked with one of the junior developers. I'm pretty sure it wasn't something that I had done, other then figuring out an effective way to make him realize that it is in his best interest to not need me to walk him through things.

Nothing threatening, simply reminding him of a couple of thing:

I brought up that I had basically reached a plateau at the company, and that I was considering pursuing other opportunities (In fact I'm planing on talking to my boss about this tomorrow).
I pointed out that if I or my boss have to walk them through the entire change, especially more then once, he wasn't really needed.
I fixed my attitude, unfortunately it involved "flipping the bozo bit" a little.
I had him answer all of the newer junior developers questions for a day.

Truthfully, I think it was the last two parts that made the difference. Both yesterday and today I was able to answer most of his questions by pointing him towards areas in the code which implemented similar functionality, and he was able to take it from there. Saving me the 10-30 minutes while I tried to explain how to implement it.

Now I just need to figure out how to get them to look beyond the source file they are working in at the time.

Can working with others code be taught?

Sean Lynch — Mon, 27 Aug 2007 11:20:01 GMT

For the last few months I have been trying to figure out how to be able to answer yes to this question. Unfortunately I have also been failing rather spectacularly at it, the junior programmers my boss hired and assigned me as something of a mentor for have shown very little improvement (sometimes even getting worse).

Unfortunately I was "gifted" with the ability to work with other peoples code, at least when I have some clue as to the intent. Now before you start saying "oh how nice for you", it wasn't said to brag, it was an excuse I keep telling myself for not being able to help them. I mean the only thing someone "gifted" with a talent would have to brag about would be something like "my <insert your deity> loves me more then you", which is just childish.

I'm sure part of it is that both of them are "at work only" programmers, so the likelihood of them doing anything listed on any of the being a better developer lists that had been going around a few months ago. As of late I have been finding myself acting more and more like a the Jeff Atwood suggests might been needed in coding discipline enforcer then a mentor and thats not doing anyone any good.

Anyways, if you have found an effective method for teaching others this talent feel free to share it. I'm getting tired of feeling like my collage statistics teacher.

WF and WCF books

Sean Lynch — Mon, 27 Aug 2007 10:31:23 GMT

I have read most of the Essential Windows Workflow Foundation book by Dharma Shukla and Bob Schmidt. I would definitely recommend it for anyone who is just starting with WF or who is just curious as to the why features were implemented a certain way. This book probably is not for you however if you are looking for a more hands on book.

Which brings me to the next book, which I wish I had started first, Learning WCF: A Hands-on Guide by Michele Leroux Bustamante. While a lot of the information in the book is available on the web, having the information pre-filtered, there is a lot of beta 3.0 stuff out there still and with 3.5 there is even more noise out there. So far this book has been very hands on, normally only a page or two before going into another lab.

So far the only complaint I have about the book is the amount of effort it is likely to take not to put it aside after the first few chapters, in fact the subconscious pressure to start running a muck with WCF started within the first 50 or so pages. Followed by a slight feeling of sadness in that I will likely never get to use what I learn in my day job.

Building my "sit and read" muscle

Sean Lynch — Mon, 07 May 2007 09:09:39 GMT

After doing some spring cleaning over the last few weeks, I have found that I had a stack of books on various topics that I had meant at one point to read. I also decided that I would like to actually read most of them, but am finding that I have a relatively weak "sit and read muscle". Looking back I’m not all that surprised by this fact, though I am a little annoyed with myself because of it (and determined to fix it). This does however seem to only be effect non-fiction reading.

Its not so much that my "sit and read muscle" is weak that annoys me, rather how “natural” most other forms of "sit and < activity>" tends to feel. I probably couldn’t count the number of times that I just sat and watched TV, in fact I often found I needed to put effort into stopping. At first I thought this might be a passive vs. active participation thing, until I thought about gaming. Since I was young I can remember periods where I would sit in front of the TV/computer and going 5-10 hours without ever moving, outside of the hand/finger motions required to control the game.

In fact about the only “sit and <activity> muscle” that is as weak is my “sit and writing muscle”. I suspect that the reasons behind the two are rather similar, likely related to how much active thought needs to go into. I suspect that part of it is tied to the fact that productive thinking tends to generate physical energy for me, which is why my leg tends to shake when I am in the zone programming. This would seem to fit with the problem, since generally the biggest obstacle to both reading and writing human languages (English) is a urge to get up and move which slowly increases in intensity.

I think to test this theory; I will try doing more reading on my exercise bike. Hopefully it will work since that would be a good amount of paper to have wasted by not reading them. It will also have the added benefit of more exercise.