Private: MY Note


Top 10 Application Security Vulnerabilities in Web.config Files - Part One

Posted in .NET 2.0 by dev1 on the October 3, 2007

Changing the default browser used in VS 2005 and Visual Web Developer

Posted in .NET 2.0 by dev1 on the October 3, 2007

Trace

Posted in .NET 2.0 by dev1 on the October 3, 2007

Security Note 
When tracing is enabled for a page, trace information is displayed in any browser requests that page. Tracing displays sensitive information, such as the values of server variables, and can therefore represent a security threat. Be sure to disable page tracing before porting your application to a production server. You can do this by setting the Trace attribute to false or by removing it. You can also configure tracing in the Web.config file by setting the enabled, localOnly, and pageOutput attributes of the trace Element (ASP.NET Settings Schema). The Trace attribute in the @ Page directive takes precedence over attributes set in the trace element in the Web.config file. Therefore, even if you disable tracing in the Web.config file by setting the enabled attribute to false, the page might still show tracing information if the Trace attribute in its @ Page directive is set to true.

Actually, I mean does page/debug trace always have to be set to FALSE for me to be able to use AJAX?

Hi,
Yes, you can’t enable trace on page for asynchronous request. That’s because the response must conform to a specified format, otherwise, it will fail.
Sincerely,
Raymond Wen
Microsoft Online Community Support

Tracing doesn’t work in the UpdatePanel, it’s basically equal to using Response.Write which is also a no-no.
-Damien

http://forums.asp.net/t/1162189.aspx 

http://www.wwwcoder.com/tabid/68/type/art/parentid/258/site/6518/default.aspx
http://msdn2.microsoft.com/en-us/library/94c55d08(VS.80).aspx

Trace on productioin

Posted in .NET 2.0 by dev1 on the October 3, 2007

http://msdn2.microsoft.com/en-us/library/94c55d08(VS.80).aspx

Security Note
When tracing is enabled for a page, trace information is displayed in any browser requests that page. Tracing displays sensitive information, such as the values of server variables, and can therefore represent a security threat. Be sure to disable page tracing before porting your application to a production server. You can do this by setting the Trace attribute to false or by removing it. You can also configure tracing in the Web.config file by setting the enabled, localOnly, and pageOutput attributes of the trace Element (ASP.NET Settings Schema). The Trace attribute in the @ Page directive takes precedence over attributes set in the trace element in the Web.config file. Therefore, even if you disable tracing in the Web.config file by setting the enabled attribute to false, the page might still show tracing information if the Trace attribute in its @ Page directive is set to true.

Debugging Firefox using Visual Studio .NET 2005

Posted in .NET 2.0 by dev1 on the October 3, 2007

http://cs.senecac.on.ca/~david.humphrey/writing/debugging-firefox.html

ASP.NET and Styles & CSS Embedding

Posted in .NET 2.0 by dev1 on the October 3, 2007

The problem here is that unlike Script references which have  a clear API in the Page.ClientScript/ScriptManager which help to make sure you don’t load multiple references to the same script files, there’s no corresponding API for CSS files. However, you can fake out ASP.NET by using the ClientScript/ScriptManager for this anyway:

string css = @”<link href=”" mce_href=”"” + this.ResolveUrl(“scripts/jquery-calendar.css) +              @”"” type=”"text/css“” rel=”"stylesheet”" />”;

ScriptManager.RegisterClientScriptBlock(this.Page, typeof(ControlResources), “_calcss”, css, false);

You can also use Page.ClientScript.RegisterClientScriptBlock. Basically you can use this API to inject anything into the top of the page, just after the FORM tag as long as you pass the last parameter as false, which indicates that you’re providing your own <script> tags - or that you are basically handling the full markup. The flag is there for compatibility with .NET 1.1 which requires that you add the script tags, but you can use this now for injecting code into the page. This isn’t ideal for CSS in all cases though: if your CSS needs to modify the body tag then this might not work correctly and as mentioned this is not XHTML compliant.

ref: http://west-wind.com/weblog/posts/158367.aspx

Dynamically Assigning ASP.NET AJAX Script References

Posted in AJAX by dev1 on the October 3, 2007

In most scenarios, the easiest way to add a script file to an ASP.NET page is in markup, as in the following example:

<asp:ScriptManager ID="SMgr" runat="server"> <Scripts> <asp:ScriptReference Path="./Script.js" /> </Scripts> </asp:ScriptManager>

This topic addresses a simple page developer scenario. For adding script references in custom controls, see Adding Client Behaviors to Web Server Controls by Using ASP.NET AJAX Extensions.