ITmeze

I’ve recently read great article by Phil Haack, JSON Hijacking. It points to some JSON vulnerabilities, basically: how sensitive data can be captured by bad people during “GET JSON” request. During my web development I always start with adding some javascript helper methods. One of them, based on jQuery, is making HTTP POST instead of GET. This should be sufficient to avoid majority of JSON attacks. So instead of $.getJSON( … ), use:

$.postJSON = function(url, data, callback) {
  $.post(url, data, callback, "json");
};

And action method with HTTP method type filter:

[AcceptVerbs(HttpVerbs.Post)]
public ActionResult DoSth(int id)
{
//.... bla bla bla ...
}

As simple as that!

Just abandon ASP.NET WebForms – the sooner You realize that – the better for You.

At the begging I would like to say that I used to be a BIG fan of ASP.NET. Before my experience with Microsoft technology started I had some really bad time with php and mysql. But that was some long time ago – in the begging of this century. Then I started playing with ASP.NET – and I really dig into it. Managed code, simplified views by use of controllers, postbacks, viewstates, widly used provider classes  - for sitemap,  database. It all looked just GREAT! I had barely any knowledge of web (html, css) and I was still able to make cool websites.  You just drag and drop button – you double click it – and You immediately get place for Your code for handling button’s click event. Yeah! Event-driven web development – that sounded exacly like something I was doing so far in windows applications.

Somehow, the longer I was playing with that, the more confused I was. All the pros suddenly showed up to be not as cool as they looked like at the beginning. Viewstate become a performance issue, I ended up compressing it, turning it off here and there.  Sooner or later I needed new functionality for controls – I ended up writing my own. Those provider models were not really “test friendly”. A sort of a turning point was when AJAX showed up. You make AJAX callback – You go through all stages for of page life cycle.  What?! I need that much to change so little.  Because I was trying to stick to Microsoft technologies and not really look around, I accepted the fact – web development is painful – it is just how it is.

The turning point was at the end of last year(2008). I was working on medium project for one of local companies. Company is small – has just a few developers. Project was just about to end when I had talk with my boss from US. I looked sth. like that:

- Boss: We are just about to release beta of our product, I talked to some web designers to make a new look for our web site.

- Me: Yeah! It sounds great!

- Boss: They will need code so that they can prepare come CSS for us…

I never consider myself a CSS guy, Our web site was functional but sort of ‘ugly’ one, so it was a big relief for me. I prepared code, send it and made sample web site public. After stg like month I received PDF file with screen-shots of Our new website. It looked just great. Everything was clear, simple and yet really eye-catchy.

Two weeks after I had approved It I received long-waiting HTML and CSS styles. And I was shocked! It looked like those designers never looked at code. What they have made will force me to write completely new rendering of nearly all used controls (navigation, gridview etc.). I was really, really angry. At the begging I was angry at my boss for not making sure we leave it to people that know sth about asp.net, then I was angry at those designers. Finally, when I calm down I realize that actually problem lies somewhere else. Let us face the fact – why those designers need to know anything about asp.net. They prepared styles and html for a view. View has nothing to do with page flow, controls and logic. It is just a View – presentation side of Your application. How the hell they should know about OnRowDataBound?

I realized – and that was painful – that WebForms does not force developers to write loosely coupled code. By providing, or better say: allowing,  page or controls events it destroys separation of concerns. Somehow view, control and business logic overlays each other. By adding ViewState it hides basic property of html protocol – it stateless. WebForm’s design make developers dumb. I am 100% serious!

So, my suggestion: Abandon ASP.NET WebForms if You can! Yes, You can! There are a lot of nice alternatives, including ASP.NET MVC, Pythod Django or Ruby on Rails. I really become fun of MVC framework – especially if it concerns web development. One of Microsoft MVP wrote that “You should at least learn ASP.NET MVC”. I would go further, You can not afford not to learn it.