James Crowley

Beware: Upgrade to ASP.NET MVC 2.0 with care if you use AntiForgeryToken

2010-03-18T13:02:00Z

If you're thinking of upgrading to MVC 2.0, and you take advantage of the AntiForgeryToken support then be careful - you can easily kick out all active visitors after the upgrade until they restart their browser. Why's this?
For the anti forgery validation to take place, ASP.NET MVC uses a session cookie called "__RequestVerificationToken_Lw__".

This gets checked for and de-serialized on any page where there is an AntiForgeryToken() call. However, the format of this validation cookie has apparently changed between MVC 1.0 and MVC 2.0.
What this means is that when you make to switch on your production server to MVC 2.0, suddenly all your visitors session cookies are invalid, resulting in calls to AntiForgeryToken() throwing exceptions (even on a standard GET request) when de-serializing it:

[InvalidCastException: Unable to cast object of type 'System.Web.UI.Triplet' to type 'System.Object[]'.] System.Web.Mvc.AntiForgeryDataSerializer.Deserialize(String serializedToken) +104 [HttpAntiForgeryException (0x80004005): A required anti-forgery token was not supplied or was invalid.] System.Web.Mvc.AntiForgeryDataSerializer.Deserialize(String serializedToken) +368 System.Web.Mvc.HtmlHelper.GetAntiForgeryTokenAndSetCookie(String salt, String domain, String path) +209 System.Web.Mvc.HtmlHelper.AntiForgeryToken(String salt, String domain, String path) +16 System.Web.Mvc.HtmlHelper.AntiForgeryToken() +10 <snip>

So you've just kicked all your active users out of your site with exceptions until they think to restart their browser (to clear the session cookies).

The only work around for now is to either write some code that wipes this cookie - or disable use of AntiForgeryToken() in your MVC 2.0 site until you're confident all session cookies will have expired. That in itself isn't very straightforward, given how frequently people tend to hibernate/standby their machines - the session cookie will only clear once the browser has been shut down and re-opened.

Hope this helps someone out there!

developerFusion community relaunches

2008-10-04T22:12:00Z

As some of you will know, I've run the developerFusion community for many years now, as a part-time hobby. Now, some big changes are afoot! 2 months ago I packed in my day job to focus on the site full-time, and have now made the first big step and re-launched the site.

You can check it out at http://www.developerfusion.com/

This is just the first step along the road, but an exciting one (for me at least!). The new site is going to make it even easier for developers around the world to connect with each other, and discover what's going on in their local area - be that events, user groups, blogs or just general discussion. We'll also be bringing a wider range of technical articles and focused developer news.

If you have any feedback, feel free to get in touch - the site is here for you! If you twitter, stay tuned at http://twitter.com/developerfusion for more updates.

UrlRewriting, .NET 2.0 SP1 and Search Engines

2008-05-26T17:05:00Z

Having been caught out by this issue once again this weekend, I thought I'd better blog about it so I don't scratch my head searching around again for a third time!

If you've been getting some wierd "Cannot use a leading .. to exit above the top directory." exceptions occuring on your site (you *do* log those, don't you?), that you can't reproduce in the browser, stay tuned. The issue crops up with URL Rewriting in .NET 2 SP1 - and the reason I've hit this again is when our production server was upgraded to .NET 3.5... evidentally this installed the service pack as a side-effect. So much for our patching strategy.

Anyway, this triggered a flow of errors for "Cannot use a leading .. to exit above the top directory.", all stemming back to a call to System.Web.Util.UrlPath.ReduceVirtualPath - but apparently only for particular visitors to the site - specifically search engine bots, including Googlebot. The issue occurs, as far as I understand, because .NET is specifically targeting code to particular browsers - in this case, I believe the issue results because it knows the user-agent doesn't support cookies, and is therefore trying to work accordingly.

There are two workarounds out there.

1. In your web.config, add the following:

This will bypass the issue entirely - by telling .NET to always use cookies for authentication - but if you require forms authentication to work in a cookie-less scenario, then this won't work. So, on to option number 2

2. Create a .browser file to match the user agents that are causing the issue. Check out this article that describes how.

Get your tech events featured on MSDN UK and TechNet UK!

2008-01-26T16:14:00Z

This announcement is well overdue, but better late than never!

After much hard work by the DPE team at Microsoft in the UK - thanks in particular go out to Clare - we've now integrated the Developer Fusion events feed with the Microsoft UK community pages. This means that anyone who submits a Microsoft technology-related event to Developer Fusion will also automatically appear on the MSDN and TechNet community pages too - talk about some great free exposure!

Any events on Developer Fusion also get automatically posted to Upcoming.

I'm also working with the larger user groups in the UK to ensure we can automatically pull in their events through the same feed format. If anyone would like more info on this, just get in touch.

Gotcha: "The specified metadata path is not valid." with ADO.NET Entities on Vista x64

2008-01-26T16:09:00Z

For those of you foolhardy enough to be running Vista x64 (myself included!), VS 2008, and the latest build of the ADO.NET Entities framework... you may well hit the following error message:

The specified metadata path is not valid. A valid path must be either an existing directory, an existing file with extension '.csdl', '.ssdl', or '.msl', or a URI that identifies an embedded resource.

The catch is that apparently the designers are not supported on 64-bit machines. The workaround is to copy two files from %windir%\Microsoft.NET\Framework64\v3.5 to %windir%\Microsoft.NET\Framework\v3.5:

Microsoft.Data.Entity.Build.Tasks.dll
Microsoft.Data.Entity.targets

then restart Visual Studio and rebuild your solution.

Thanks to Tommy Williams @ MSFT (found on the forums)

Shared Printers across Windows Vista and Windows XP

2007-10-28T14:50:00Z

Since getting a shiny new machine running Vista, I'd been having a bit of grief trying to get it to print to my Canon i6500 printer shared through another Windows XP machine. Vista has built-in support for the printer (running locally), but when trying to add it across a network, as the XP machine could not supply the correct 64bit Vista drivers, the Vista machine wasn't too happy - pointing to the correct location of the local device drivers didn't help either!

After sifting through various solutions - this was the one that worked for me.

On the Vista machine,

- Choose to add a local printer
- Create a new local port, and set its name so it matches the network share (\\server\name)
- Manually select the appropriate printer driver from the automatically supported set (or select an appropriate vista driver)

This then tricks Vista into thinking we have a local printer - so it can install the correct drivers - that actually redirects to the network printer.

I think this should work in the reverse direction too, if Windows XP is geting upset printing to a device shared through Vista.

Hope this helps someone!

Upcoming (Free) UK Developer Events

2007-10-08T08:03:00Z

There's so many great events coming up all around the UK at the moment - and best of all, they're free. If you haven't tried one yet, check out the UK developer event listings to find one near you. Here are just a few

db4o: An Embeddable Database Engine for Object-Oriented Environments

Wednesday, 10 October 2007, 19:00 - 21:00 in Glasgow, United Kingdom. FREE (Scottish Developers)

Jim Paterson describes the key features of db4o, and shows how to save objects in the database, use the db4o query mechanisms, control transactions and object activation, refactor databases, replicate data to a relational database and use db4o in a web app. You will also find out about extensive the developer resources provided by the db4o community.

Microsoft® SharePoint® Server 2007 - Capture The Opportunity

Friday, 12 October 2007, 10:00 - 14:00 in London, United Kingdom. FREE! (Content and Code)

Discover the multitude of solutions offered by a Microsoft® SharePoint® Server 2007 platform. Enjoy interactive breakout demonstrations as well as a buffet lunch. Demonstrations will focus on: data capture, enterprise content management, document management, search, forms server as well as business intelligence, dashboards and KPIs.

The Lost World: Win Services

Monday, 15 October 2007, 19:00 - 21:00 in Birmingham, United Kingdom. Free to members. Non members can attend 2 meetings FOC. (NxtGenUG)

Intrepid Explorer Liam Westley takes a trip back in time as he dives into Windows and looks at developing Windows Services. Remember those? Well, in case you hadn't noticed they're all around us in the development world, but hard to see and hard to capture with a debugger! Liam shows us how we can make our lives easier when writing and working with Windows Services including some of the differences between NT and Windows Vista Services. Other gigantic things to see on the night : Pizza-o-sa...

MSDN: What’s new in Visual Studio 2008 and .NET Fx 3.5 for the Web Developer

Tuesday, 16 October 2007, 18:00 - 21:20 in Edinburgh, United Kingdom. FREE (Microsoft)

Come along and find out what’s in store for both the ASP.NET platform and Visual Studio in the upcoming release. As web developers, there’s a lot to get excited about including many features you can take advantage of in your existing projects.

SQL 2008 Your Data, Any Place Any Time

Thursday, 18 October 2007, 09:00 - 13:00 in Bradford, United Kingdom. FREE (Black Marble)

Black Marble present a seminar on SQL2008 with an Introduction for IT Managers. This outlines the change in emphasis from "words and numbers" to "sights and sounds"

Future of Web Apps in London - (plus 20% discount!)

2007-09-25T18:52:00Z

Future of Web Apps have a run a great set of events in both the US and the UK - and there's one coming up in London on Oct 3-5. Just to give you a taster, there are speakers from

Digg
Flickr
Facebook
WordPress
FeedBurner
Yahoo
Adobe
Microsoft

Not bad eh? Even better - Developer Fusion has organised a 20% discount off the full ticket price, which brings the two day conference pass down to less than £200. Give me a shout too if you're going to attend - I'm planning to make it.

C#/VB.NET Code Translation tweak

2007-09-12T21:29:00Z

I've been getting a *lot* of feedback recently over the changes we made to the C#/VB.NET code translation tools to try and tidy them up - but unfortunately broke a somewhat crucial ability to copy the code out in IE6! I'm still not sure why IE6 is so unhappy with the CSS and is preventing any sensible selection in the output page (any suggestions welcomed).

However, I've now implemented a "view plain source" and "copy to clipboard" option which should at least get around this for now!

Free Silverlight Training

2007-09-04T15:00:00Z

If you've been wanting to get up to speed on Silverlight but haven't had the time yet - then you might be interested in this. Developer Fusion has teamed up with InnerWorkings to offer some totally free Silverlight training, to all Developer Fusion visitors.

We're also got, amongst others, a 15% discount on DevelopMentor training, and 10% discount on the source code and hosted version of Gemini (from CounterSoft) - the bug tracking system that the team behind dotnetnuke use. More details are available on our free member benefits page.

If you have any feedback, or offers of further discounts to our visitors, just get in touch!

Gotcha: HTTP_X_FORWARDED_FOR returns multiple IP addresses

2007-06-19T21:00:00Z

I hit a small gotcha this evening. A visitor to Developer Fusion reported that they couldn't gain access to the site at all, because our IP address detection logic was failing. We were checking the "HTTP_X_FORWARDED_FOR" header for an IP address, before falling back to REMOTE_ADDR, turning the IP into a long integer, and doing an IP-to-country lookup in our database. Which seemed safe enough!

As it turns out, HTTP_X_FORWARDED_FOR can sometimes have a comma delimited list of IP addresses - so what we actually needed to be doing was take the last IP address in that list, before doing our conversion to an integer.

Thanks go out to Francois Botha, one of our visitors, for helping me track down this issue!

C# <-> VB.NET Converters Updated

2007-06-09T14:28:00Z

We've just updated our free C# to VB.NET and VB.NET to C# converters on Developer Fusion - they're adapted from the neat little utilities within the free .NET IDE, #develop . They now keep your comments in tact too. Great for when you've found those bits of sample code in the wrong language! If you haven't come across them before, they're well worth a look.

[Update: They support generics now too!]

BT Web21C SDK - Sending SMS, Voice Calls and Location Based Services

2007-05-22T20:43:00Z

Another interesting side-point from the discussion this morning - Joe Black, director of Emerging Business and Technology at BT pointed me in the direction of their new Web 21C SDK - available in .NET, Java, PHP and Python. What this does is exposes a load of functionality allowing you to integrate with their systems - including sending SMS, voice messages, conference calls, and location-based services. The service will ultimately work by purchasing "credits" for use within the system - but you're free to experiment within certain pre-set limits at no charge.

There's also an interview of two of the guys involved up on channel9, and some demo "mashup" apps using the technology - including one that will send you details of the nearest restaurants based on your location after you send an SMS.

Good stuff, and well worth a look!

Microsoft Generational Roundtable

2007-05-22T20:24:00Z

I took part in an interesting debate today, organised by Microsoft, discussing the latest generation of new graduates, their role in the IT industry - and how they shape it, or are shaped by it. The discussion covered a broad range of issues, and definitely got those brain cells working! Some of the things raised were....

How our current education system stimulates (or fails to stimulate) innovation, and whether educational institutions - at all levels - could do more to support this.
Establishing closer ties to business, at university level if not earlier - so students can engage with not only academics, but tap into the experience and knowledge of individuals with years of experience in the industry
How can we address the huge gender gap in the IT industry - can leading women within the industry to try to break down some of those preconceptions by engaging with potential students at an early stage?
Moving towards a increasingly flexi-time, telecommuting business world - will businesses that fail to adapt to accomodate their employees needs struggle to hold on to staff? How will this affect working hours?
Looking forward to the next 5-10 years and how technology might further change the way we work.

All in all, a very good morning, with some very interesting folks!

Dynamically Generating PDFs in .NET

2007-03-14T13:12:00Z

It's perfectly possible to generate a PDF from scratch, using a library such as iTextSharp, a port of a free Java PDF library. However, it can be hard work defining all the code you need to generate the layout you're after, and impossible for someone to tweak the layout without going back to the developer.

One alternative, using the same free library, is instead to design a PDF document in a WYSIWYG environment such as Adobe Designer, and define some dynamic fields within the document. Your code can load this PDF form, set the value of each of the fields, and output a flat PDF. This would enable you to, for instance, have an invoice PDF template defined, set a bunch of fields within the PDF, and output as a flat PDF document - without needing a load of code generating the PDF from scratch.

The code itself is very straightforward. We're going to send the resulting output to the ASP.NET response stream, so we need to set the content-type and also a content-disposition header so that the result appears as a file download.

Response.ContentType = "application/pdf"; Response.AddHeader("Content-disposition", "attachment; filename=tokens.pdf");

Note that we could just as easily be using a file stream, and would therefore replace the above with opening a stream to the appropriate file path. With that out of the way, we use a PdfReader object to load our existing PDF from the local file system; in this case, from ~/assets/form.pdf.

PdfReader pdfReader = new PdfReader(Request.MapPath("~/assets/form.pdf"));

Next we create a PdfStamper object, which will allow us to modify the form fields defined in the PDF and save the result. We pass it the PdfReader object representing the PDF file, and a stream we want the result sent to. Finally, we set the FormFlattening flag so that we get a flat PDF rather than allowing the fields to remain editable.

PdfStamper pdfStamper = new PdfStamper(pdfReader, Response.OutputStream); pdfStamper.FormFlattening = true; // generate a flat PDF

We can then set the dynamic fields defined within the PDF form, and close our pdfStamper object.

AcroFields pdfForm = pdfStamper.AcroFields; pdfForm.SetField("InvoiceRef", "00000"); pdfForm.SetField("DeliveryAddress", "Oxford Street, London"); pdfForm.SetField("Email", "anon@anywhere.com"); pdfStamper.Close();

Closing the pdfStamper object results in the PDF being written to the stream we passed in the constructor, and we're all done. Simple!