Bill Robertson's Blog

Password Protect Staging Sites IIS7

Bill Robertson — Tue, 30 Aug 2011 01:44:00 GMT

If you have a website you are ready to launch and still want some client feedback on it and want to keep pesky search indexes away it is easiest to give a user/pass to your client for them to look at it. Perhaps it is on a staging domain, yes there is the robots=”no follow”, but sometimes you really want the staging site to be private.

With IIS 6 you would set forms authentication in your web.config and go into IIS and turn off anonymous authentication and bind it to a windows user account. This worked well, although a little time consuming setting up the account, permissions, password management, however, one of the consequences of the tighter integration with the .net runtime and IIS was the loss of the ability to have both password protect and forms authentication on a site. For a variety of reasons this makes sense.

Included is an HttpModule that will enable you to quickly password protect a site and still retain all the forms authentication behavior.

<appSettings>
    <add key="br-username" value="bob" />
    <add key="br-password" value="sally" />
</appSettings>
/.../
<!--this second is defined here for cassini-->
<httpModules>
    <add name="PasswordProtect" 
         type="BillRob.Web.PasswordProtectHttpModule, BillRob.Web" />
/.../
<!-- this section is for iis 7 -->
<modules runAllManagedModulesForAllRequests="true">
    <add name="PasswordProtect" 
         type="BillRob.Web.PasswordProtectHttpModule, BillRob.Web" />

And add a reference to BillRob.Web. The HttpModule itself is very basic, it hooks the BeginRequest, as to not interfere with any other processing. If the password app settings are defined, it will check the Authorization header of the incoming request and check it against a basic digest hash. (Does anyone see how unsecured this process is?) All modern browsers support this type of WWW-Authenticate header.

if (!String.IsNullOrEmpty(username) && !String.IsNullOrEmpty(password))
{
    var data = String.Format("{0}:{1}", username, password);
    var correctHeader = "Basic " + 
          Convert.ToBase64String(Encoding.UTF8.GetBytes(data));
    string securityString = request.Headers["Authorization"];
    if (securityString == null)
        goto forceRedirect;
    if (securityString != correctHeader)
        goto forceRedirect;

    return;
forceRedirect:
    var host = request.Url.Host.ToLower();
    response.AddHeader("WWW-Authenticate", 
		String.Format(@"Basic realm=""{0}""", host));
    response.StatusCode = 401;
    response.End();
}

Yeah, that’s right, I used a goto statement. Here is a zip of the full sample application and a prebuilt assembly.

PasswordProtectSites.rar

I've added this as a GitHub repo. https://github.com/billrob/billrob-web

Replace Spaces With Tabs

Bill Robertson — Thu, 21 Apr 2011 05:14:00 GMT

Our code base was diverging with tab people and space people and it needed to be addressed. It can be quite dramatic having the “tabs vs spaces” developer discussions. If the discussion is at a post conference bar trip, you can name call, insult, belittle the opposite position. When this comes up at work it is vitally important the goal is to have consistency

We had a team meeting about it and the vote came down to 4v4 with some abstainers. We decided the vote with the only way reasonable people can to resolve things. We all bowed our heads and prayed to the Almighty God--

Of course not. I said reasonable people. We decided via paper-rock-scissors. It was a tie the first round. Both sides regrouped and finished dramatically with 2 wrapping defeats of spaces versus tabs.

Having proved the superiority of the tab argument, it came time to decide who would go in and standardize the code base. I fell on that grenade because I was the one that pulled the pin.

Tabify was mentioned. I did some bing searches, installed Visual Studio Power Tools, found the tabify, found out it doesn’t do the whole project. Wasted effort. Then realized it messed with all my studio settings for keyboard code navigation and ( ) { } autocompletion spacing. Took another 30 minutes to uninstall, settings partially restored, had to go find an old settings backup file. Jesus

Pulled out my trusty console application and wrote a console utility to do it. I’ve attached the code and it is pretty simple to follow along.

Good luck with your future tabs vs spaces troubles and I hope this helps anyone who is facing this same issue. This will also convert from tabs back to spaces.

AllFilesInARecursiveDirectoryTreeReplaceSpacesWithTabs.rar

Happy 21th Chad Starkey

Bill Robertson — Wed, 21 Jul 2010 20:02:00 GMT

I wrote the following eulogy years ago when my brother, Chad, was misdiagnosed by John Tilley of Phoenix Associates in Flower Mound. He went to see the doctor Friday complaining of stomach pains. The doctor examined him and sent him with medicine for a stomach virus. He went to sleep that evening to get doctor ordered rest. During the night his appendix ruptured and was found dead the next morning. He was 14 years old.

I was 11 when Chad was born. I thought it was so awesome to have a brother that much younger. I already had tying shoes all figured out when it was time to teach him. Reading was covered. Multiplication tables all memorized. I taught him that Might is Right when it comes to rough housing and fighting. I wanted to teach him about being a catcher and pitcher. I was waiting to teach him about computer programming. Jimmy and I both were counting the days to teach him about mischief, but from what I have heard, he had that one figured out already. And girls. This year for Christmas I bought him a blue etch a sketch. I told him it would come in handy when his girlfriend wanted to talk, because you girls love to talk on the phone.

Last night I during my dazed wandering among his scores of scores of friends, I began to see my brother’s life through their eyes. I heard words such as “he always made me laugh”, “he was so nice”, “he never said anything mean about anyone”. Much, much more was said through the awkward postures, the tearful embraces, seeing tough boys become real men, and the genuine pain I saw in your eyes.

I knew my brother was loved by me, but it was incredible witnessing how truly loved and respected he is by so many. He has verily touched each and every one of us with his sparkling eyes, his infectious smile and his simple love of life. Chad was quickly becoming the greatest man I know. He has acquired more sincere and caring friends in his remarkable 14 years than I will in my entire life.

It’s been said to me many times that Chad has gone to a better place. But he hasn’t gone anywhere. He came into my heart on July 21, 1989 at 5 in the morning with Jimmy and me sleeping shoulder to shoulder on the hospital floor. And he will abide in my heart until I join him again…and there, Chad, you will be my teacher.

Unfuddle SVN Power Commands

Bill Robertson — Tue, 11 May 2010 06:20:00 GMT

Came across this digging into unfuddle tonight.

http://unfuddle.com/docs/topics/powerful_commit_messages

I've always known about #40 creating a change set. I found tonight that entering a checkin comment of:

resolves #40 Fixed spacing on the email line.

Will resolve ticket number 40 it and document it more fully in one step. No more going to the website and filling it out twice.

There are assign commands a couple others.

resolve #26
assign #25 & #26 to alex

Will resolve one tickets and assign both of them to alex. Nice trick if you’ven’t seen it.

DataContractSerializer Converting Objects to Xml String

Bill Robertson — Tue, 09 Feb 2010 23:19:00 GMT

This isn't so much a post as a place I could put a common pattern of code. .NET 3.5 introduced the 10th or 12th iteration of a serializer. I've stopped to look up this pattern many times and wanted to put a quick sample up with the serialize and deserialize pattern for xml to object mapping.

This will turn the tempData object into an xml string.

   1: var serializer = new DataContractSerializer(tempData.GetType());

   2: using (var backing = new System.IO.StringWriter())

   3: using (var writer = new System.Xml.XmlTextWriter(backing))

   4: {

   5:     serializer.WriteObject(writer, tempData);

   6:     data.XmlData = backing.ToString();

   7: }

This will return a full object. This instance is using a generic based approach.

   1: var serializer = new DataContractSerializer(typeof(T));

   2: using (var backing = new System.IO.StringReader(data.XmlData))

   3: using (var reader = new System.Xml.XmlTextReader(backing))

   4: {

   5:     return serializer.ReadObject(reader) as T;

   6: }

If there are actual questions about this and how to use it post it below and I might put together a real post about this.

Killing Windows Live Messenger Photo Share "Feature"

Bill Robertson — Wed, 14 Oct 2009 01:13:00 GMT

(This post applies to version 14.0.8089.726)

Several versions ago windows live messenger decided it would be best to make the photo sending experience horrible. If you want “attachment” based functionality where you can actual open, see it, zoom, basically make the image sent usable, the windows live team decided it wasn't going to support it anymore.

I’m only putting this post together so I can quickly send people who are complaining about it to fix it on their machines. The following posts give a full explanation.

This is the best resource, but only works for older versions.

This covers the new version, but he only provided his site and not the post url, so you might have to dig for it.

Completely exit Microsoft Messenger
Download XVI32.
With XVI32, open c:\Program Files\Windows Live\Messenger\msnmsgr.exe
Browse in file to location: 0×164118
Change the Hex Code “74” to “EB”
Close the program and save the file.

Download this fixed version. ONLY version 14.0.8089.726
Put in path C:\Program Files\Windows Live\Messenger

Luckily this seems to fix even when people without the fix send files and they come in correctly.

MVC Spaghetti Code

Bill Robertson — Wed, 19 Aug 2009 03:12:00 GMT

Some professional background info first. I started my tech career as a network technician setting up networks and hardware support. I was interested in programming back in 1997 (actually 321 Contact magazine on a Commodore 64) and it seemed back then, web was the way of the future. I spent a week working on an asp (classic) project and knowing c++ just couldn’t stand the unstructured syntax for rendering the pages. I left IT to go back to grocery stores.

I’ve been on this MVC project for 6 weeks now. I making progress and learning exactly what it behind the idea. Simply put, your Controllers are the CodeBehind for your pages. Rather than have one code file for each page, you have one code file for a plethora of “Views”. I really don’t care. A View is simply a page and changing the name doesn’t mean squat.

I am going with it and working within the framework they provide, but had to post how ugly this code was. Remember, I avoided classic asp because of the slaughtering of readability.

I just wanted to alternate the style on table rows. I admit the <%= ip.AttemptedCount %> is worlds better than <% Eval( “AttemptedCount”) %>. The “.ToShortDateString” is better than googling (or binging) the string format codes. But seriously, this is the default formatting for the code. I’m confident there is a more readable way to do this.

I want to also add that intellisense is the greatest developer tool created by Microsoft and even that is failing in this situation. I'd almost rather turn off the validation for this type of logic when it is inside a funky script block. I highly tout intellisense and has enabled me to become a better developer around self discovery of code and sure beats the hell out of looking in a book, which is where I started before the web really took off.

You can lecture me about HtmlHelper extension methods, and I’ll accept that, but seriously, this doesn’t seem to be that crazy of an idea: let’s alternate the style on the table rows.

I’ll take any advice to make this more readable, but why abandon the entire idea of server controls. Extracting this type of functionality is what makes server controls so much better than dryly rendering basic html.

Asp.net MVC Without SessionState

Bill Robertson — Wed, 15 Jul 2009 17:32:00 GMT

When writing my first real MVC application, I instinctively turned off SessionState in the web.config.

<sessionState mode="Off" />

When I started the application I received this error:

The SessionStateTempDataProvider requires SessionState to be enabled.

I crawled into it further and MVC by default requires SessionState for one type of ActionResult. There is the concept of TempData in MVC where you can load some data, perform a redirect, and the temp data will be there on the next request. Using TempData across web requests is a solution for keeping data across the stateless nature of the web.

The application I’m writing will be hosted in a Farm. I know there are solutions for using session state across the farm, primarily through SqlStateServer or setting sticky sessions on the load balancer machines. However, even sticky sessions won’t work for me because I like the ability to take a server out of rotation and it not affect my users.

The workaround is simply to create your own ITempDataProvider and attach it to your controller. The ITempDataProvider has two methods: LoadTempData and SaveTempData. Here is my implementation of ITempDataProvider I use now.

public class NoTempDataProvider : ITempDataProvider

    public IDictionary<string, object> LoadTempData(ControllerContext controllerContext)

        return new Dictionary<string, object>();

    public void SaveTempData(ControllerContext controllerContext, IDictionary<string, object> values)

        if ( values.Count != 0 )

            throw new NotImplementedException("Can not set tempdata, no session state available");

The Load method just returns an empty collection. The Save method won’t do anything either. However, you’ll notice the save method checks to make sure the framework doesn't try to persist any state. If so, it will blow up, letting your developers know this isn’t supported.

Of course you can just create your own base Controller that you can use in your application; this sample is using the MVC Sample Application, AccountController. Now you have to wire this new provider to the controller, line 5:

   1: public AccountController(IFormsAuthentication formsAuth, IMembershipService service)

   2: {

   3:     FormsAuth = formsAuth ?? new FormsAuthenticationService();

   4:     MembershipService = service ?? new AccountMembershipService();

   5:     this.TempDataProvider = new NoTempDataProvider();

   6: }

If you decide you need some sort of TempData storage you can just process the data in the Load/Save methods and use your own custom data storage. I’m hoping to not need this as I move forward in this application.

Human Interaction Amazes Me

Bill Robertson — Tue, 07 Apr 2009 03:19:00 GMT

Sorry all for the bad photo, you could read it on my iphone, but when I uploaded it, it horribly mangled the photo. Here is how it looked on my phone. with an transcription below.

I also realized my neighbor’s name was on the paper. However, I wanted to give those interested the story, and get around to writing another blog post. That gets Windows Live Writer in my recent when I click start and should “hint” me to remember.

Dear Neighbors

Whoever “took” my newspaper, I would appreciate if you would have allowed me to read it before you.

You are welcome to knock on my door and I would gladly give it to you, however, only after I’ve had the change to peruse it first.

Goto Statements

Bill Robertson — Wed, 21 Jan 2009 23:15:00 GMT

I've been quietly lobbying to my programmer friends about the utility of using the old "goto" keyword. I've gotten a little push back from them, mostly dismissive scorn, but hey, not everyone can be good. :) I should start a series on this and this will serve as my first post on the glories of GOTO.

The other day I posted a twitter image showing a good case of a goto statement.

This is a utility method I use when parsing Xml documents into objects. I received some push back from this specific twitter, mainly from my friend @gbattle. The requirements I gave to Greg were: "no nested if's, no multiple exits, no unnecessary object assignments and better error explanation"

He posted about his code for doing the same thing without using gotos. There were a couple points where he was incorrect, and I wanted to walk through his post. I start trivially and then increase for performance and readability. He still made his points regardless of the library being used. There was only one point, property accessing, that does behave different in .NET than say C++.

I will accept from Greg that breaking down each error condition into exactly what caused the specific failure might be better, but on a utility method like this, if I can wrap up the failure condition into a single statement be accurate, I'm fine with it. "Node should have one child CDATA section with data." Sure, specifically telling the user which 3 words of the all inclusive error might be better, but any software dev that can't follow that error message and look at the node that caused the failure, prolly should not be programing anyway.

// For style reasons, I always put the constant on the lhs within an if statement
// for the compiler to automatically discover nasty undesired assignment errors
if (1 != node.ChildNodes.Count)

I understand the sentiment of the lhs positioning of constants, and in my c++ days, I was an advocate of his pattern; however in .NET it is an error to do an assignment in an IF evaluator. (Which was extremely frustrating starting out because I wanted to do it sometimes)

// There is no reason for you to create a new XmlNode return the value.
// You waste time creating a new object and the assignment. Not needed.
XmlNode dataNode = node.FirstChild;

The assignment operator doesn't create a new object. It creates a pointer to the return object of calling property FirstChild. Creating a pointer to a Property result is the fastest way to access the property when you are accessing it more than once. When loading an property it first must resolve the memory location of the containing object, then look into its method offset table, calling the accessor (get) method, which walks more memory offsets, to return an object. Rather than repeatedly calling the Property (get method) I store the results in a stack variable pointer to the actual data returned by the Property call. (I'm ignoring the code inlining that might occur at run time, but that doesn't meet the speed of storing the reference locally)

Now the money shot for why gotos are good in this situation is something in his code he did not account for. When he is checking the number of ChildNodes off the parent node, if it comes out to zero, he has opened his code up for a NullReferenceException. If ChildNodes.Count == 0, then FirstChild will be null. Checking FirstChild.Value when first child is null will result in an exception. And here lies the nested if statements that I'm trying to avoid.

If the ChildNodes.Count property is 0 (or negatively not 1, the actual node count we are looking for), then you must branch this utility method into either a quick return or a nested if statement that continues checking the validity of the XmlNode when there are the correct number of ChildNodes.

NYC January Code Camp and the Large Object Heap

Bill Robertson — Tue, 13 Jan 2009 16:29:00 GMT

I presented my Garbage Collection/Memory Management talk this last weekend at the NYC Code Camp at the Microsoft Office. I had a great time and it was enjoyable catching up with old friends and meeting new people.

Attached is the slides and code samples.

To the gentlemen who was asking about the Large Object Heap and DataSets. A DataSet will not be placed on the LOH. A value of a DataColumn instance might be placed there, but the DataSet itself has a footprint much smaller than the 85 K size required to be placed there.

The Large Object Heap is a heap structure used by .net to allocate large objects greater than 85K. It is not the size of the object graph that places it on the large object heap. Translated to this example, the memory allocation of the DataSet is NOT the size of all the rows and all the columns. The size of the object is determined immediately before the constructor executes (before the DataSet has any rows). This is determine purely by the size of all the fields in the object, and some additional object overhead.

When the memory size is determined and is (currently) above the threshold of 85K, it is placed in the Large Object Heap. The LOH is very similar to the Small Object Heap in behavior with the ptrNextObj and serial allocation. (The one covered in the session). However, it does not have generational support and most importantly the LOH is never compacted.

The lack of compaction is what will create out of memory exceptions because the LOH becomes fragmented and with the new allocations always appearing at the end of the heap, you can run out of memory.

Using the new 2.0 MemoryFailPoint object you can test the allocation and create an InsufficientMemoryException rather than the more fatal OutOfMemoryException.

This is only a tease because you still can't force a compaction of the LOH. It is valid, in some scenarios, force a GC.Collect to help with the SMO and free up some memory. However, the SMO is usually handled quite well by the CLR's collector and calling GC.Collect is nothing more than Jazz Hands to make you feel important. Don't call it, ever...unless you have a good reason...but never call it.

PDC 2008 Recommends List

Bill Robertson — Sun, 02 Nov 2008 05:15:00 GMT

I thought I would share the sessions at the PDC I really enjoyed and would recommend for viewing for those that didn't attend. And you know who you are. :) And those who did attend but didn't get to watch these. I'm sure there are more that were great, but these are the ones that stuck out to me.

Deep Dive: Dynamic Languages in Microsoft .NET

Jim Hugunin gives a great session on Dynamic Languages. This was the best talk I went to the entire PDC so I'm listing it first, but you should watch The Future of C# below first. It is very reminiscent of the few Computer Sciences courses I've taken. You won't learn any skills here that will directly apply, but covers theoretical aspects of cross language support. He is also very entertaining to boot!

The Future of C#

Anders Hejlsberg shows what's coming in C# 4.0. He covers Dynamic Languages with javascript from c#, optional parameters values for overloads and named arguments.

With the dynamic language potentials, they must find a way to have an intellisense generator just like how the asp.net designer has its own plug in framework. Maybe with interop type generation?

dynamic video = youTubeServer.GetVideo( "" ); // returns xml

   1: dynamic video = GetYouTubeVideo( "3f73fv" ); //returns wrapped xml string

   2: ltTitle.Text = video.Title;

   3: ltObject.Text = video.Embed;

The c# interpreter was really neat at the end.

ASP.NET and JQuery

Stephen Walther taught me everything I needed to know about jquery in his hour long talk about it. I know javascript extremely well and this just filled in the gaps so I could transfer my existing knowledge. In fact, I am refactoring my advanced javascript talk to include jquery now, especially since it was announced Visual Studio will formally support JQuery.

ASP.NET: Cache Extensibility

Stefan Schackow explains how the new Cache Api can work and what you can do when you open up the caching framework. This will allow more powerful extensions such as David Penton's Cache Pattern being tied directly into the framework.

Project "Velocity": A First Look

Murali Krishnaprasad does a good job introducing the new distributed caching framework called "velocity". The option of a sending a read/write provider to a cache call has some interesting possibilities.

How to log remote user off...remotely

Bill Robertson — Thu, 09 Oct 2008 17:24:00 GMT

You're about to leave for the day, but you need to push one more thing to the data center. You pop open trusty Remote Desktops and connect to your environment. Then this message hits you in the face like a wet, smelly dog tail.

"Connect to console"? Nope that doesn't help. Normally, you holler across your team and tell whoever isn't on the servers, to log off; however it's late and everyone else is gone. Or if someone is already on the server, ask them to use taskmgr to find your least favorite person and force them out of the server. (Does anyone else get a power rush out of that?)

The above only works when you have access to the server. When you don't, you can log people off remotely.

There are two commands that are included in at least Windows Server 2003 and beyond:

quser.exe - used for querying users logged on to a server
logoff.exe - used for logging user off a server

Using just quser.exe will give you the list of users that are logged onto the current machine. You can also query a remote machine using the /server:<machinename>. This will give a list of users. The import things to notice are the ID and the State. There are two states that I use when deciding who to kick off: Active and Disc.

I always try to kick off Disc before active. (There's no additional explanation)

After you pinpointed the user to bounce, look at the ID column because that's what the logoff.exe command needs.

The screen shot below shows how to query the users on WEB01 and then log off the disconnected session, named Session ID 2.

With nearly all dos commands, passing "/?" as the only parameter will give you additional information about these commands.

August NDDNUG Advanced Javascript Presentation

Bill Robertson — Fri, 08 Aug 2008 19:22:00 GMT

I had a great time presenting an advanced javascript and MS Ajax at the North Dallas .NET User Group. Attached is the slide deck and code samples I used. I know...I didn't clean up the project files so there are some extra dll's included.

The code samples are located at /Default.aspx and they run in increasing complexity.

The code samples include:

Ajax Helper - Helper class for registering client side script to work with MS Ajax, including the powerful RenderUserControl method.
Object pattern - This includes a javascript singleton pattern, namespaces, constructors, inheritance, static and instance methods.
Event Modal - Two different patterns for event handling in javascript, with a focus on my preference Event Level 0, inline function declarations.
JSProcessor - This will combine multiple JS files into one and will remove excess spacing, comments to make the raw JS as small as possible.
JSShortCircuiter - For reaching around the embed scripts when in debug mode so you don't have to constantly rebuild the dlls.

There are many examples of client side caching, retrieving html from server, getting and saving Server Side objects.

There was more interest than I thought on the client side ThreadPool object, so I've included that. It isn't functional as it stands because there are some other frameworks it relies on. Send me a message or post in the comments if there is interest for me to make this object standalone and only require the .net framework and I'll work towards that.

Also, if there is any interest I can release a ajax back button module. It is different from the MS Ajax one in that it is delegate based rather than serialized querystrings.

Hit me with any feedback or questions you have on the presentation or the code.

Thanks!

download

Posting Again

Bill Robertson — Fri, 08 Aug 2008 19:20:00 GMT

After a long hiatus, I'm back to posting again. Look forward to more frequent updates. :)