Server Control and Custom Control

• Building block of the GUI
• E.g. Textbox, Button , drop down list ...
• E.g. Validation, Security , Master Page and data manipulation.

5 Type of Control :

• HTML controls
• <a>,<button>,<input type>
• HTML server controls
• HTML control with runat=server
• Able run in ASP.NET
• ASP.NET server controls
• Validation control
• Data source control - data binding
• Data view control - list and table from data source
• Personalization control - personalization of page based on user information
• Login and security control
• Master Page
• Navigation control
• Rich control - file upload and calendar control
• ASP.NET AJAX server controls
• User controls

Custom Control

• Compile into DLL and used as any other ASP.NET server control.

Different Custom Control and User Control

• Custom control are compiled into assembly (.dll), user control are not.
• Custom control can add into toolbox, user control cannot.
• Custom control are difficult to create, it has no designer, and everything done by code; user control are easier to create as similar to creating web pages.
• Single copy of custom control can be used in multiple application (just browse to the location); A separate user control is required in each application. 

Security

Authentication - who can request the page ?
Authorization - what page can request ?

• Form authentication
• setup in used for internet web application, relies on configuration in web.config.
• First time user access to protected resource, ASP.NET will redirect user to login page.
• If login is successful, ASP.NET will give authentication ticket (cookies) to user.
• The expiration time of ticket can be configure.
• different web config in folder can be configure different set of access.
• authorization deny user=? , put in main page, so anonymous users cannot access.
• authorization allow user=* , put in register so everyone can in.
• authorization allow role="admin", deny user=* , except admin all cannot access.
• Windows Authentication
• identifies and authorizes users based on the server's user list
• Suitable for intranet web application.
• Don't force users who already logged in to Windows and log in again.
• Good For in house use and behind firewall.
• Cannot work through firewalls.
• Not for internet use. 
• Passport Authentication
• Rely on a centralized authentication service provided by Microsoft
• Install and Configure .NET Passport SDK.  
• email address and password
• Google account can login youtube, blogger , gmail

• When enable impersinate (true)
• To use existing Windows user permission, user identity as the account you logged in.
• False = IIS APPPOOL\DefaultAppPool
• True = Dk\oby
• user must authenticated by IID
• To give each web application different permissions
• No matter what user access the application, it will become the preset specific account

Authorization

<location path="HRpages">
  <system.web> 
    <authorization>
      <allow roles="HR" />
      <deny users="*" />
    </authorization>
   </system.web>
</location>

<location path="salesPages">
  <system.web> 
    <authorization>
      <allow roles="sales" />
      <deny users="*" />
    </authorization>
   </system.web>
</location>

<deny users="?" /> <!-- Allow all users -->

IIS

• IIS is a web server to deliver web pages to clients using HTTP
• run type"inetmgr" to check IIS is installed.
• Worker process 
• ASP.NET run under a process, it responsible for all request and response processing.
• w3wp.exe
• Application pool 
• Allow run a group of web sites, web application or web services.
• 1 App Pool Container of 1 worker process.
• Web applications run separate processes to isolation between them.
•  WAS 
• Manage Application pools and worker processes for HTTP and non-HTTP request. 
• Determine worker process is running or not. if not, it will start a worker process. 
• spawns worker processes, monitors their health, recycles them if necessary and makes sure none of them consume more resources than specified AppPool configuration. 
• WAS is also the arbiter and collector for run-time and state data, e.g. performance counters, site and Application Pool state.
• HTTP.sys (Hypertext Transfer Protocol Stack)
• Implement at Kernel Mode.Without switch to user mode.
• Listen HTTP request from network, pass request to ISS process and return response to client browser.
• http.sys know which app pool handle the request, because new app pool ID will registered with http.sys
• Kernel mode request queuing. request cause less overhead in context switching. If no worker process available to accept request, the kernel mode request queue will hold the request until a worker process pick it up.
• Request pre-processing and security filtering.

• IIS 5.0 all app domains are hosted by a ASP.NET worker process.
• IIS 5.0 run on windows 2000 or XP
• IIS 5.0 single process host all application, if killing this process, all other application will restart.
• IIS 5.0 do not have App Pool.

• IIS 5.0 single aspnet_wp.exe. (All request are dispatched by ISAPI extension hosted in inetinfo.exe, and pass to aspnet_wp.exe)
• IIS 6.0 no use aspnet_wp.exe, it use worker process (w3wp.exe) which is not single, it can be many instance.
• IIS 6.0 no use inetinfo.exe to forward HTTP request to ISAPI extensions.
• IIS 6.0 handle Incoming request at lower kernal level (http.sys) insteal of user mode and route to the app pool. IIS 5.0 request is received by user mode (inetinfo.exe)
• IIS 6.0 run on windows server 2003
• IIS 6.0 allow application run inside different copy of a new worker process, w3wp.exe. Each app pool can contain mutiple App Domain and is hosted in single copy of worker process.

• IIS 6.0 keep a single copy of metabase in global process (intelinfo.exe).
• IIS 7.0 no use metabase and use XML Configuration files that located alongside Web content. Each worker process loads a unique copy of configuration.
• XML config file can read by human
• IIS 7.0 run on Windows 2008
• IIS 7.0  URL Rewrite
• IIS 7.0 Better UI
• IIS 7.0 has 40++ module (basic, anonymous, windows authentication, logging, FTP)
• IIS 7.0 has Classical and Inegrated mode. Classical is back to IIS 6.0

Classical Mode / Integration Mode

• Classic mode
• the only mode in IIS6 and below
• IIS (request/response) pipeline is separate with ASP.NET pipeline.
• Is a mode where IIS only works with ISAPI extensions and ISAPI filters directly. IIS treat ASP.NET as an external plugin implemented in ISAPI and only give out the request to ASP.NET. when it's needs.
• Integrated mode
• Integrate IIS request pipeline and ASP.NET request pipeline. ASP.NET is no longer treated as an external plugin.
• HttpModules have power as an ISAPI filter  and  HttpHandlers have power as an ISAPI extension. ASP.NET is a part of IIS.
• Unified process model, eliminates steps that previously duplicated in IIS and ASP.NET. E.g. Authentication and authorization.
• Enable manage to all content types (images, text files, HTML), that’s why HttpHandler and HttpModule can handle it.

IIS 6.0 Process Model

Request  > Http.sys (kernel mode) > (user mode)WAS > App Pool  > w3wp.exe = asp.net_isapi.ddl create HTTPRuntime object process the request via HTTPModule and HTTPHandler > Page Life Cycle

Web Service

• Communication platform between different or same platform applications that allow to use the web method.
• Standardized XML messaging system. (Send and Response using XML)
• Not tied to any OS and programming language. (Java can talk to C#, Windows can talk to Linux)
• Visual studio using information of WSDL to create Proxy class to help (steps) :
1. Serialize the parameters 
2. Prepare SOAP request message 
3. Send to Web Service.
4. Web Service execute the method and return SOAP response message to proxy.
5. Proxy deserialize soap message and hands in the application.

Component of Web Services

• SOAP (Simple Object Access Protocol)
• is a communication protocol between applications
• is independent language and platform.
• is an XML based messaging protocol for exchange information
• UDDI (Universal Description, Discovery and Integration)
• Is a specification for a distributed registry of web services.
• create a standard platform enable company or application easy to find the web service.
• Use WSDL to descrive the interfaces to web services.
• WSDL (Web Services Description Language).
• Standard format for describing web service
• Describe all methods, parameters and return type.
• A client program connecting to a web service can read WSDL to determine what functions available.
• E.g. Operations, Type (Data Type), Binding, 

How Web Service Work

• XML to tag the data
• SOAP to transfer a message.
• WSDL to describe the availability of service.

Windows Communication Foundation (WCF)

• .NET 3.0
• Use for distributed application ( Web Server + Web Service Server)
• 1 Web service and configure many endpoint as support all client needs. (HTTP/TCP) (XML,Binary)
• Serialization : Process of convert an object into XML
• [Serializable] put in class , all property will be serialize. You cannot control only 1 property need to serialize.
• [DataContract]  you can control which property need to include/exclude in serialization, and each of the property add [DataMember] - (you can define name, order, required
• DataControl very limit control the SOAP message, MessageContract give full control.
• MessageContract 
• Use to tweak the structure of the soap XML Message.
• include custom information in the SOAP header E.g. User Credential, license key, session keys and etc.
• Change name of the wrapper element in SOAP Message.
• Encrypt message and paramater. Use ProtectionLevel named parameter.

Javascript, JQuery, CSS

Javascript 

• Program behavior of web pages, web browser.
• Interpreter language (no need compile). [C# is Compiled Language]
• Case Sensitive
• Use Client side processor to execute.
• Faster, not require to process in the web server and sent back with server bandwidth. 
• Reduce Load on servers.
• Disadvantage :
• Security issue, the java script can exploit by user.
• Many version, different version may have different result. and also different browser too.

JQuery - Make it easier to use Javascript on your website

CSS 

• Describe how HTML element should display.
• Development faster, Low maintenance, no need change in every page.
• Disadvantage : 
• Fragmentation, different dimensions with each browser and also device (PC and mobile)

• select all p elements inside a div element? div p
• select elements with class name "test"? .test
• select an element with id "demo"?  #demo
• border-width:10px 1px 5px 20px; (Top, Right , Bottom, Left)

XML, XHTML, XPath, XSLT

XML (Extensible Markup Language)

• A computer language which use mark up and is capable to being extend.
• XML was designed to store and transport data
• Markup : Notation or Symbol used to correct in marking up text and indicate how text should be display (<, >, ^,?,/)
• Extensible : Capable to expend or add by Developer.
• XML Element 
• Case Sensitive : Open and Close Tag but be same. E.g. <chap>
• Not overlap
• XML Document should have 1 root Element e.g. book
• XML attributes 
• single or double quotation (' or ")
• Good for html
• XML Declaration  (prolog)
• optional, but if has, it must 1st line and no other content.
• version + character encoding used in document
• version is mandatory and encoding is optional (Support UTF-8 or UTF-16.)

Avoid using XML attributes

• attributes cannot contain multiple values (child elements can).
• attributes are not easily expandable (for future changes).
• attributes cannot describe structures (child elements can).
• attributes are more difficult to manipulate by program code.
• attribute values are not easy to test against a DTD.

When use XML attributes and element

• Element is store part of the data, attribute is not (ID, counter or unique identifier)
• Element store data itself, attribute is store metadata.

XML VS HTML

• XML was designed to carry data - with focus on what data is.
• HTML was designed to display data - with focus on how data looks.
• XML tags are not predefined like HTML tags are.
• XML has rule, HTML no rule.

XHTML

• newer version of HTML, strict rules.
• Consist 3 parts : DOCTYPE, Head and Body.
• All Tags closed
• <!DOCTYPE html> -is Document Type Definition (DTD), specifies what type of document is this (XHTML)
• <html xmlns="http://www.w3.org/1999/xhtml"> - specifies the namespace, tell browser all tags contained within <html> belong to CHTML namespace as definesd by the W3C
• <meta> tag is used to specify keywords that describe a document's contents (name & content)
• Example: <strong><p><br /><h1>

HTML	XHTML
No closing tag <br>	Tag are extensible <br />
Tags are not case-sensitive <Body>	Tags only allow lowercase <body>
Attribute optional be quoted <a href=index.html>	Attribute must be quoted <a href="index.html">
Overlapping tags <b><i></b></i>	No overlapping tags <b><i></i></b>

XPath

• Language for define parts of an XML document. It Is a major element in XSLT.
• uses path expression to navigate in XML.(allow condition)
• E.g. /bookstore/book[price>35]
• E.g. /root_tag/element_a/element_b
• Selection and addressing elements and attributes in an XML document. E.g. Select node

XSLT

• eXtensible Stylesheet Language
• Transformation of XML document into HTML, XHTML (become XHTML got tables or line that match with XML) E.g. people.xml + people.xls
• XPath identifies the parts of an XML document that should be transformed, and XSLT says how the transformation should be done

XML vs JSON vs CSV

YAML

Most easily understood as an extension of JSON. Has a notion of aliases that allow object graphs of arbitrary complexity to be created. Has a concept of metadata like tags that can be used for proper typing.

Advantages: XML - Lots of libraries, Devs are familiar with it, XSLT, Can be easiily Validated by both client and server (XSD, DTD), Hierarchical Data JSON - easily interpreted on client side, compact notation, Hierarchical Data CSV - Opens in Excel(?) Disadvantages: XML - Bloated, harder to interpret in JavaScript than JSON JSON - If used improperly can pose a security hole (don't use eval), Not all languages have libraries to interpret it. CSV - Does not support hierarchical data, you'd be the only one doing it, it's actually much harder than most devs think to parse valid csv files (CSV values can contain new lines as long as they are between quotes, etc).

Partial Classes

• ASP.NET use partial class to designer and code behind, so button can found in code behind.
• A single class, struct or interface divide to multiple source code files.
• Code Generators / designers to separate with user edit to the files, clean framework
• 2 Developer can work in different source code for a single class.
• Inherit 2 Interfaces , 1 partial class handle 1 interface.
• When writing the code, it will have intellisense to not allow you to make duplicate or find the properties in this 2 files.
• At compile time , these multiple files get combined into a single class.
• Partial methods
• private and must have partial keyword.
• must void.
• implementation is optional
• can ref param but not out param