Posts

Showing posts with the label MVC

Restrict non-ajax requests using ActionMethodSelectorAttribute

In ASP.Net MVC each coming request is routed to a certain action method inside some controller and with JQuery it became piece of cake to call this action method using ajax. In some scenarios we need to restrict the incoming requests to be ajax request only, fortunately ASP.Net MVC represent a new method to Request object called IsAjaxRequest() that return true if the current request come from ajax call and return false if current request is normal request(typing url in address bar of a browser, click a link to this page,..etc). We can use that method to deny any request come from ajax call or vise versa. public class HomeController { public ActionResult Index() { if(Request.IsAjaxRequest()) { //Do something } else { //Do something else } } } As we see if we need to make this check many times in our project, we will rewrite the same if statement for each action we need it be called via ajax only, but is there anot...

Generic CheckBoxList in ASP.Net MVC

In ASP.Net  web forms you can easily create a list of check boxes and bind it into a data collection using CheckBoxList control and specify which property will be the text of each check box and which one will be the value of the check box. You even don't need to write it, you can drag it from tools window, drop it into your page and set its properties and style with wizards that Visual studio provide. But in ASP.Net MVC there is no any server controls like that exists in web forms, all what we have is a helper methods to create HTML tags. In  ASP.Net MVC we have two helpers methods for creating a check box, Html.CheckBox and Html.CheckBoxFor that will be rendered as just one check box. If we want to create many check boxes or check boxes list we can call it inside a loop as follows @foreach (var item in MyCollection) { @Html.CheckBox("checkBoxName", new {value=item.checkBoxValue })@item.CheckBoxText<br /> } Here is a generic extension method for creat...

Safe ASP.Net MVC application against cross site attacks - 1

Do you trust user input?!!!!!!!. If your answer is YES, stop reading and do something else. If your answer is NO, I think reading this article may help you to make your site more secure. All user's inputs can be a back door for attacker to attack your site. User's inputs that we will categorize as un-trusted inputs are : Incoming URLs including Request.QueryString[] values Form post data ( Request.Form[] values including values from hidden fields and disabled fields) Cookies Data in HTTP Headers (such as Request.UserAgent and Request.UrlReferrer ). Your site could be attacked by altring the query string, form values, or cookies data. The solution is not to prevent request manipulation but to check that each request is a legal request for the logged-in visitor. Cross-Site Scripting and HTML Injection: If an attacker can get our site to return some javascript to our visitors, then the attacker's script can take control of our visitors' browsing session and...

Design Patterns Series 20 - Double Buffer, Recycle Bin, and MVC Patterns

In this post we will explore the last three patterns in our design patterns list, Double Buffer Pattern , Recycle Bin Pattern , and Model/View/Controller (MVC) Pattern. Double Buffer Pattern : Double Buffering is used to avoid screen flicker when you are displaying graphics. The idea is that you perfrom your multi-step graphics creation off-screen in a buffer and then flash the results on the screen when they're complete. The process is called Double Buffering  because the screen display buffer is one buffer and the buffer in which the images are prepared is the second buffer. Use a Double Buffer  when generating revised datasets for an asynchronous processor. When the new data is complete and self consistent, redirect the asynchronous processor to the alternate buffer. Recycle Bin Pattern : If your code uses many objects and the object-creation process is time - and resource - intensive, you might want to use the Recycle Bin Pattern . The idea is that when you're do...