Skip to main content

Posts

Securing Controller Actions in ASP.NET MVC for Multi-Tenant Applications

One of the cool things about using the MVC Framework is that you get clean RESTful urls e.g. /Product/Edit/1 This is all well and good but when developing a multi-tenant application which uses a Shared datastore it is extremely important that your controller actions are secure in the sense that the Urls can’t be tampered with. Believe it or not but this level of security is often neglected in a lot of projects or is at the least an afterthought. You could implement in every controller action something like below: public ActionResult Edit( int id) { if (!catalogService.HasAccessToProduct(UserContext.UserId, id)) { HttpContext.Response.Status = "401 Unauthorized" ; HttpContext.Response.StatusCode = 401; Response.End(); } var product = catalogService.GetProductById(id); ViewData.Model = product; return View(); } However ...

Pre-Generating Views in Entity Framework .NET 4.0

  UPDATED ON: 16/09/2010 If you’re using Entity Framework chances are you’ve come up against performance issues already, especially when instantiating your Object Context. One very reliable way to increase performance is to pre-generate the Views. Depending on the size of your model and in my experience it can shave as much as 40% off the instantiation time. There is a good overview on MSDN , however it only covers .NET 3.5. Step 1 Go to your Model properties and select “ Copy to Output Directory ” for the Metadata Artifact Processing option. The result of this is you will end up with the .ssdl, .csdl and .msl files in your output directory which in this case is bin/Debug. Step 2 Next you need to setup the Pre-build event to use the EDMGen.exe tool. NB: If you use the Command on the MSDN site you will come across this error. “The required parameter ‘mode’ is missing” The correct command to use is: "%windir%\Microsoft.NET\Framework\ v4.0....

Using Entity Framework Self Tracking Entities with Workflow Persistence in .NET 4.0 RC

I just ran into a problem when trying to use Workflow Persistence with Self Tracking Entities in .NET 4.0 RC. The execution of the InstancePersistenceCommand named {urn:schemas-microsoft-com:System.Activities.Persistence/command}SaveWorkflow was interrupted by a n error. ---> System.Runtime.Serialization.InvalidDataContractException: Type ‘ElasticSoftware.DownloadSheriff.Domain.Model.Entities.TrackableCollection`1[ElasticSoftware.DownloadSheriff.Domain.Model.Entities.Customer]' cannot be serialized. Consider marking it with the DataContractAttribute attribute, and marking all of its members you want serialized with the DataMemberAttribute attribute.  If the type is a collection, consider marking it with the CollectionDataContractAttribute.  See the Microsoft .NET Framework documentation for other supported types. By Default the TrackableCollection in the Types.tt is not annotated with a DataContract attribute. You can fix this by going to Line 1401 and adding the D...

Breaking Changes for Visual Studio 2010 RC

Just installed the Visual Studio RC and have come across the following issues. System.Runtime.Persistance has been replaced by System.Runtime.DurableInstancing All the Workflow Persistance Schema and Logic has changed and there is no Migration path. You can find the latest scripts here: C:\Windows\Microsoft.NET\Framework\v4.0.30128\SQL\en\ These were the only issues I had when upgrading a 30 project solution. Really enjoying the increased speed combined with ReSharper 5.0

Disabling the Shut Down button on Windows Server 2008

The very first thing I do when building an Amazon EC2 image is too disable the Shut Down button. Shutting Down an instance has the same effect of terminating the instance, meaning you lose all data not stored on EBS volumes. Click Start > Run > Type “gpedit.msc” and press enter Go to User Configuration > Administrative Templates > Start Menu and Toolbar The option you are looking for is “Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands” Right Click > Properties > Select Enabled > Click Apply > Click OK Now when you go to the Start Menu you will see this with the only options being Lock and Log Off. Now you can use the AWS Management Console to manage reboots or terminations.

Migrating to Amazon EC2 from GoGrid

Recently Amazon EC2 announced that they were going to support Windows Server 2008 instances. The experience with GoGrid has been rocky to say the least and most recently the MyGSI’s shortcomings confirmed that the service was not able to meet our applications requirements for using instances on demand. Which brings me to this post. After 14 months with GoGrid I have just recently completed a migration of all applications and databases to Amazon EC2 and thought I would outline the steps I took. Creating New Instances Before you start you will need to create your new instances in Amazon EC2. I have covered this previously in another post . When you set up the firewall it is important that you open Port 1433 for traffic coming from your previous web server in GoGrid. Or if you want you can even create a temporary VPN between your GoGrid web server and EC2 database server using Amazon Virtual Private Cloud . This is an important step in ensuring minimal downtime. At this...

Configuring Custom Error Pages on IIS7

One thing that often trips me up whenever I setup a new Windows Server 2008 box is the IIS default error pages for standard error codes 401, 404, 500 etc. These seem to override the Custom errors section in your Web.Config. If you notice above the default for IIS7 is: “Detailed errors for local requests and custom error pages for remote requests” In order to make use of the Custom error pages in your Web.Config you need to select the “Detailed Errors” option.