The basics

At the very least, you should add an [Authorize] attribute to every controller or controller Action in case you want some of the controller actions to be accessible by anonymous users. For example, you probably want ALL users to have access to the login and register actions of your web application.

By decorating the HomeController with the Authorize attribute (notice I did not specify any user role) the application will prevent any unauthenticated user from executing any of the actions in this controller.

[Authorize]
public class HomeController : Controller
{
  //...
}

The following is an example of decorating a controller action with the Authorize attribute, you want to do this when you only want to restrict access to some of the actions in a controller instead of all actions.

[Authorize]
public ActionResult Create()
{
  //...
}

Protecting against Cross-site request forgery attack (CSRF or XSRF)

The Authorize attribute offers protection that is sufficient in most cases. However, there is security hole with this and thus it opens your web application for a cross-site request forgery attack. For example, after a user logs into your site the website will issue your browser an authentication token within a cookie. Each subsequent request, the browser sends the cookie back to the site to let the site know that you are authorized to take whatever action you’re taking, so far everything is good.

Here is the problem with only using the Authorize attribute, let’s say that a user is logged in to your website and then they go to a spam site by clicking on a link that points to another site which causes a form post back to your site… this is bad, your browser will send the authentication cookie to your site making it appear as if the request came from your website and initiated by an authenticated user when it really didn’t.

The above scenario is called cross-site request forgery and can be avoided by adding the ValidateAntiForgeryToken attribute available in the .NET framework, this attribute is used to detect whether a server request has been tampered with.

The first step is to add the ValidateAntiForgeryToken attribute to every Post Action as follows:

[HttpPost, Authorize, ValidateAntiForgeryToken]
public ActionResult Create()
{
  //...
}

The next step is to add the HtmlHelper method @Html.AntiForgeryToken() inside the form in your view.

The way the ValidateAntiForgeryToken attribute works is by checking to see that the cookie and hidden form field left by the Html.AntiForgeryToken() HtmlHelper essentially exists and match. If they do not exist or match, it throws an HttpAntiForgeryException shown below:

“A required anti-forgery token was not supplied or was invalid”

By adding the ValidateAntiForgeryToken to your controller actions your site will be prepared to prevent CSRF/XSRF attacks.

Implementing Forms Authentication using Active Directory (AD)

Often times you might run across a project where you need to authenticate users of your website using Active Directory credentials, the good news is that you can use the existing “Account” controller to achieve this, only a few modifications are necessary.

When you create a new MVC Web Application project and choose the Internet Application template, the Account controller is added to the project, you can use this controller with AD to authenticate your users. For the Account controller to work with AD we need to remove all Actions but the following:

• Logon()
• Logon(LogOnModel model, string returnUrl)
• LogOff()

Your Account controller should look like the following after you remove the unnecessary Actions such as ChangePassword, Register, etc…

After this, go ahead and clean up the AccountModel as well so the only model class left is the LogOnModel:

Lastly, add the following to the project’s web.config file:

That is all! the first code snipet is the connectionstring to your Active Directory server and the second one is where we specify Active Directory as the application’s default membership provider.

Save your changes, hit Ctrl-F5 and logon to your application using your domain/AD account.

Hopefully this will help you get started to secure your ASP.NET web apps and show you a very simple way to use ASP.NET’s membership services with Active Directory.

In a later post I will show how to use Active Directory groups to restrict access to controller actions and make your application even more secure!

I just installed SQL express 2008 recently and wanted to use it for a test application that I have in a hosted server. I wanted for this application to connect to my local SQL express 2008 database but soon I found out I needed to do some adjustments for this to work. So this is what I did to make my local SQL express 2008 db accept remote connections.

1. Go to Start – All Programs – Microsoft SQL Server 2008 – Configuration Tools – SQL Server Configuration Manager
2. Select and expand the SQL Server Network Configuration node and then select your SQL express 2008 database. In the window to the right, right-click on TCP/IP and click on “Enable”.
3. Once you have enabled the TCP/IP protocol, right-click on it and select Properties, go to the tab labeled “IP Addresses” and make sure you clear any values under TCP Dynamic Ports (even if it is 0, remove it), and then add a new port number on each one of the TCP Portproperties. In my case I used port 14330.
   Click Apply and OK.
4. You now need to restart SQL express 08, to do this, select the SQL Services node in the same SQL Server Configuration Manager and the right-click on the name of your SQL express 08 instance and select restart. If you receive any errors trying to restart your server, go back to step 3 and make sure you did everything I mentioned, if the error keeps coming up, then use a different port number.
5. Finally, you need to make sure a remote connection can be made to your SQL server, so we need to open the port you assigned on step 3 (in my case 14330) in your router and make sure Windows firewall and/or any other firewall accept incoming connections to this port.

That’s it! your SQL express 2008 server should be able to accept remote connections now. As always, make sure you take the appropriate steps to make sure your systems are secure.

Good Luck!

The Controller

First, create a controller that will serve these images and add a void method that requires the image id as parameter to locate the right image to serve. In the example below I used the Adventure Works database and Linq to query the database and read an image stored in MS SQL. Make sure you set the content type to the right type of image file you’ll be getting from the database, in the example below I used “image/gif” as the content type.

The View

In your view, you only need to use the Url.Action helper to form the url to the image stored in the database by calling the method in the image controller you just created (see above).

“Show” is the name of our method and “Image” is the name of the controller, what’s on the right to “id=” is just the image id that I want to get.

I’ve used the following infinite scroll solution with ASP.NET MVC sites and it works great and it is simple to implement, all you need is jQuery and a little code in the controller and the view.

First, add a parameter to the controller action that returns the data for your page, this parameter is the one that we’ll use to specify the page number we need to get data for. The real work happens in the GetPaginatedProducts method, every time the user scrolls down the page this method is called by the controller action, we pass the page number and then use the Skip Linq command to get the next set of items.

The Controller

Here is the code we need in the controller for the infinite scroll to work:

The JavaScript

The following is the javascript needed to display a loading image and to initiate the call to the Product action on the HomeController, see below. Also, you will need to create a loading image to display while the application is getting data from the server, I used this site to create mine.

The View

Finally, in the view we make sure we have at least two divs, one with the id “productList” where the data is appended to when scrolling to the bottom of the page and another one with the id “loading” to use it to display the loading image:

Where is the sample project?

I’ve added the sample project to CodePlex, you can download it here: http://infinitescroll.codeplex.com/

During this time I have been able to collect about 60 names of people who are interested in TidyContact, and about half of them showed enough interest to actually pay a monthly subscription for it, that is good. It is truly difficult to develop a product from scratch without any help from other developers, designers, etc… at the same time, it is rewarding every time I reach a milestone such as completing a feature, finishing a module, getting the landing page done, etc… I am looking forward to launching the beta version soon and hope to get valuable feedback to make the application better before the first version launches. I would say I am about 70% done with the version I want to release to beta users, I believe in releasing a minimum viable product and all that stuff, but since this application is something we’ll be using internally in TodoTax.com it won’t make sense to release it if it doesn’t do at least what we want it to do.

I enjoy being involved with different projects and doing different things, keep focus is not easy. However,  balancing your life between your startup, family and other projects is also not easy and it should be the most important thing, no doubt about that. Being surrounded by family and doing things not related to software development are key to avoid burning out, this keeps the motivation high and it helps when feeling down.

Regardless of the time spent so far, which is much more than I originally expected, the journey has been both interesting and fun. Because of this project, I have pushed myself to get out there more often than usual, traveling to attend conferences such as the Business of Software and even organizing meetups to get to know bright people and help them any way I can, with this I also help myself.

Working in TidyContact has proven to be very beneficial to me as a developer, it is a different product where I have full control of what it would look like, what features should have, what technologies I use to build it, etc… it helps me balance the frustration that all developers sometimes experience by not having control of the projects or technologies we can work on. This project has also helped me to get better with things like SEO, conversion rates, A/B testing, and other things that are usually not part of a developer’s primary responsibility.

The application’s security, data schema and most of the backend code has been completed, at least the first version of it. The user interface is what is left to do, about 50% is done but this has been a difficult process since creating a good user interface and a great user experience is never an easy task. Loading the application fast, avoiding pages postbacks and building an intuitive application is all part of it and this takes time and skill to do.

In the next few weeks the first version of the UI should be close to completion and so the beta version will be released, after that I’ll start iterating on it more often to make sure I can go from beta to version one in just a matter of weeks and not months.

Fast forward to 2005, that is when my family and I moved from Minnesota to Austin, Texas and at the time Sanchez Plus Services had about 100 paying clients and the little business was already very profitable! the interesting part is that we never opened an office or even had a website… in fact, we didn’t even met with our clients in person, it was all a phone/fax operation and I just worked on it after work during tax season (February – April). After the 2005 tax season I decided to stop preparing taxes for other people and started doing computer consulting instead since that was my day job anyway, at this point my wife took over Sanchez Plus Services which she had already been helping run for a few years already and knew how to handle it and get things done.

Today, she has managed to grow this business from about 150 clients in 2006 to around 400 and she is the only running this show. Today Sanchez Plus Services has an outdated basic website and even a Facebook page with contact information and nothing else. All of the customer acquisition has been through word of mouth and since we don’t have an office where people can go to, Sanchez Plus Services’ clients cover various states such as Minnesota, Texas, Arkansas, California, Oklahoma, etc… and to this day, all of the communication with these customers is still handled by one person and using a combination of phone, email and fax (I know!). The client’s contact information resides in a variety of places such as Excel files, a custom application, MS Access, Outlook and a product from Intuit called Customer Manager.

After Sanchez Plus Services grew to more than a few hundred clients, managing the communication, notes and reminders for all those clients became a big problem and a big pain. The tool that promised to help us manage this mess was Intuit’s Customer Manager application but it has proven to be very slow and buggy, specially when syncing data with other programs. This is where the idea for TidyContact was born.

There are many CRM applications out there, we know. However, most of the applications we have tried focus on sales tasks such as creating and manage leads, proposals and the like. Our tax preparation business don’t track that, all of our customers come from word of mouth and there is really not a sales process other than just simply prepare their tax return and then charge them for the number of forms filled and for other consulting services in case they need to resolve an issue with the IRS. Our little tax preparation business needs a tool to manage our existing contacts and the communication we have with them, nothing else.

The application that we need should be a tool to consolidate, organize, and manage contacts. It should allow to add notes and reminders about contact’s calls, emails, etc… It should let you find a contact’s detailed information and notes with just a few clicks in just a few seconds and that is what TidyContact is and promise to do for us, yes we are scratching our own itch.

When I started Sanchez Plus Services over 10 years ago I didn’t think of it as a business, and yes I know is a micro business but still a business. It generates a nice revenue and it is profitable, a bit more than ramen profitable I would say. The tax preparation business was started to offer a better option for people who want to avoid having to go to the national tax preparation firms that employ temporary workers to basically do data entry and that for the most part don’t have the required knowledge about taxes to actually help you when preparing your personal and/or your small business taxes.

I want to do the same with TidyContact. A simple application that solves one problem for small businesses.

TidyContact is not a CRM, it is not a proposals and deals track tool, and it is not just contact sync tool. TidyContact is a simple contact manager application for small business. It lets your consolidate contacts from various places such as LinkedIn, Google/Gmail, Outlook, etc and it also let you add notes.

I am almost done with the development of this application which I have been bootstrapping from the beginning and working on it at nights and whenever possible. I talked to some small business owners and other people who are self-employed and many of them are interested in trying it and even pay for it! I have about 50 people now signed up to try the beta version of it and I just hope that a few of them end up signing up for it and become customers for many years, like those of Sanchez Plus Services.

If you think TidyContact could be useful for you and your business, please sign up for a demo which is coming very soon, and if you have any questions or feedback about TidyContact please use the comments section below or email me. I am always here to help.

A few months ago, I put together a new PC which I use for development when I am home and for gaming. I installed Windows Ultimate 64-bit in it and up until today, I didn’t worry about connecting it to the WHS because I didn’t have much to backup, now I do.

The first thing I tried was to install the WHS connector using the original CD, I didn’t have any luck. Then I searched for a solution online and I found this article, but it didn’t work either. In the article, the writer mentions that I can just browse to http://youwindowshomeservername.com:55000 and then install it from there. I was able to see a button to install it, but when I clicked on it I got a “Not Found” 404 error. As it turns out, the link points to “/setup/WHSConnectorInstall.exe” and that path doesn’t seem to be configured in the web server. I searched for the folder Setup in the WHS and found it. After trying running various executables including “WHSConnectorInstall.exe” without success, one of the error messages suggested running Setup.exe (what a surprise!), so I did and I was able to install the Windows Home Server in my Windows 7 64 bit computer without any problems. The connection works perfectly and I also was able to configure this computer to be backed up by WHS every night!

These are the steps I followed:

• Copy the files shown in the image below from the folder “C:\WHS” in your Windows Home Server to a local folder in your Windows 7 computer.
•  These are the executables I copied from WHS to my WIndows 7 computer, double-click on setup.exe and follow the screen instructions.

•  That is it! After running setup.exe you should see the WHS icon in the system tray.

NuGet

How to get it

NuGet can be installed from here or from Visual Studio’s Extension Manager located under the Tools menu.

The awesomeness of it

Before NuGet, the way we incorporated third-party libraries into our projects was by doing the following:

1. Download third-party library (and any dependencies) from the web.
2. Unpack them (as many of them come in compressed files) to a folder in our project, I usually create (or created) a folder labeled “lib” and placed all the third-party libraries there.
3. Import to the .NET project.
4. Make any necessary changes to the config file when needed.

If a new version of NUnit became available and you wanted to use it in your project, you’ll just need to type the following command in the Package Manager Console to update NUnit using NuGet: PM> Update-Package nunit

The NuGet Gallery

Where does this copy of NUnit comes from you might ask? if you look closely at the image above, you’ll see a Package source field in the upper left corner of the window, this is the default NuGet package source and it basically points to NuGet’s service at http://packages.nuget.org/v1/FeedService.svc/.

These third-party libraries are hosted by Microsoft and the list of third-party libraries available in NuGet increases every day.

As of today, there are 1,418 packages available in NuGet’s official package service. You can browse the different packages available in NuGet by visiting the NuGet website, by opening the Add Library Package Reference located under the Tools menu (Tools – Library Package Manager), the Add Library Package Reference is also available in the Add Reference menu, and my favorite, by typing the command PM> Get-Package -ListAvailable in the  Console… if you do this, just have in mind that it will take a while to list all the libraries available

For those that prefer the clicking instead of the typing, the Package Manager Console (UI) is your tool, below is a screen shot of what it looks like:

From this window, you can see a list of the installed packages, a list of all the packages available, you can search and install any package you might need to as well; this is all in a per-project basis. What this means is that if you have a solution with multiple projects and you want to have a library such as NUnit available to all projects or at least available in more than one project… you’ll have to add it to each individual project – yes! this isn’t ideal, I know.

Phil Haack, Senior Program Manager for the ASP.NET team, recently wrote about the possibility of adding the ability to use a single package version per solution, instead of project. I think this is a great idea and many people probably won’t start using NuGet in their multi-project solutions until this is available. Phil or @haacked for those who follow him on Twitter, also took the time to add a survey to his blog post and based in the results of this survey, it looks like the majority of the people who responded agree that having the option to have a single NuGet package version per solution is not only ideal, it is necessary.

How to Contribute

You can develop your own NuGet packages and upload them to NuGet.org so they can be shared with others, all you need to do this is to create an account on NuGet.org and then upload your NuGet package. Detailed instructions on how to create a NuGet package can be found here.

What’s New

The team working in NuGet seems to be very active and new versions are coming out often, they just released a new version of NuGet about a week ago and these are the steps in order to update to the latest version, NuGet 1.3

To update from the Extension Manager 

Go to the Tools menu in Visual Studio, click on Extension Manager and you’ll see the window below:

To update NuGet.exe 
With this release comes also a new version of NuGet.exe, this is the same tool that package authors have been using to create packages and upload them to NuGet gallery. If you haven’t downloaded it yet, you can get the latest version from NuGet’s CI server here. After you download it, and once a new version comes out, to update you’ll only have to type the following nuget.exe u command as shown below:

You can read all the changes, updates and new features released with NuGet 1.3 here.

Well, that is all I have now regarding NuGet, I do like this tool and I think it will be very useful for all .NET developers. I am working in another post that will show the steps to follow to create your own nuget server/gallery (yes, the code for the nuget service is open source and available to anyone interested!), upload your own nuget packages and make them available to your team. The idea is that a company developing in the .NET platform can take advantage of having their own nuget service running internally so their developers can share their own class libraries and the like by using nuget and their local nuget service/gallery. This is better than shared network folders, emailing dlls, etc…

If you liked this post, consider subscribing to my blog, you can also follow me on Twitter http://twitter.com/ricardodsanchez

• Mango: code name for coming version of Windows Phone 7 (WP7).
• ASP.NET MVC 3 Tools update
• Entity Framework 4.1
• Silverlight 5 Beta
• NuGet
• IIS Express
• SQL Compact Edition 4
• Internet Explorer 10 Preview