Securing Asp.Net MVC Application by using Authorize Attribute

Authorization is the process of determining the rights of an authenticated user for accessing the application's resources. The Asp.Net MVC Framework has a AuthorizeAttribute filter for filtering the authorized user to access a resource. Refer this article for Custom Authentication and Authorization in ASP.NET MVC

Authorize Attribute Properties

Properties

Description

Roles

Gets or sets the roles required to access the controller or action method.

Users

Gets or sets the user names required to access the controller or action method.

Filtering Users by Users Property

Suppose you want to allow the access of AdminProfile to only shailendra and mohan users then you can specify the authorize users list to Users property as shown below.

[Authorize(Users = "shailendra,mohan")]
public ActionResult AdminProfile()
{
 return View();
}

Filtering Users by Roles Property

Suppose you want to allow the access of AdminProfile action to only Admin and SubAdmin roles then you can specify the authorize roles list to Users property as shown below.

[Authorize(Roles = "Admin,SubAdmin")]
public ActionResult AdminProfile()
{
 return View();
}

What do you think?

I hope you will enjoy the tips while programming with Asp.Net MVC. I would like to have feedback from my blog readers. Your valuable feedback, question, or comments about this article are always welcome.

Understanding Caching in Asp.Net MVC with example

Caching is a most important aspect of high-performance web application. Caching provides a way of storing frequently accessed data and reusing that data. Practically, this is an effective way for improving web application’s performance.

Advantage of Caching

1. Reduce hosting server round-trips

   When content is cached at the client or in proxies, it cause minimum request to server.

2. Reduce database server round-trips

   When content is cached at the web server, it can eliminate the database request.

3. Reduce network traffic

   When content is cached at the client side, it it also reduce the network traffic.

4. Avoid time-consumption for regenerating reusable content

   When reusable content is cached, it avoid the time consumption for regenerating reusable content.

5. Improve performance

   Since cached content reduce round-trips, network traffic and avoid time consumption for regenerating reusable content which cause a boost in the performance.

Key points about Caching

1. Use caching for contents that are accessed frequently.
2. Avoid caching for contents that are unique per user.
3. Avoid caching for contents that are accessed infrequently/rarely.
4. Use the VaryByCustom function to cache multiple versions of a page based on customization aspects of the request such as cookies, role, theme, browser, and so on.
5. For efficient caching use 64-bit version of Windows Server and SQL Server.
6. For database caching make sure your database server has sufficient RAM otherwise, it may degrade the performance.
7. For caching of dynamic contents that change frequently, define a short cache–expiration time rather than disabling caching.

Output Cache Filter

The OutputCache filter allow you to cache the data that is output of an action method. By default, this attribute filter cache the data till 60 seconds. After 60 sec, if a call was made to this action then ASP.NET MVC will cache the output again.

Enabling Output Caching

You can enable the output caching for an action method or controller by adding an [OutputCache] attribute as shown below:

[OutputCache(Duration=20, VaryByParam="none")]
public ActionResult Index()
{
 ViewBag.Message = DateTime.Now.ToString();
 return View();
}

The output of the Index() action method will be cached for 20 seconds. If you will not defined the duration, it will cached it for by default cache duration 60 sec. You can see the cache effect by applying the break point on index method as shown below.

  

OutputCache Filter Parameter

Parameter

Type

Description

CacheProfile

string

Specify the name of the output cache policy which is defined with in <outputCacheSettings> tag of Web.config.

Duration

int

Specify the time in sec to cache the content

Location

OutputCacheLocation

Specify the location of the output to be cached. By default location is Any.

NoStore

bool

Enable/Disable where to use HTTP Cache-Control. This is used only to protect very sensitive data.

SqlDependency

string

Specify the database and table name pairs on which the cache content depends on. The cached data will expire automatically when the data changes in the database.

VaryByContentEncoding

string

Specify the semicolon separated list of character set (Content encoding like gzip and deflate) that the output cache uses to vary the cache content

VaryByCustom

string

Specify the list of custom strings that the output cache uses to vary the cache content.

VaryByHeader

string

Specify the semicolon separated list of HTTP header names that are used to vary the cache content.

VaryByParam

string

Specify the semicolon separated list of form POST or query string parameters that are used to vary the cache content. If not specified, the default value is none.

Output Caching Location

By default, content is cached in three locations: the web server, any proxy servers, and the user's browser. You can control the content's cached location by changing the location parameter of the OutputCache attribute to any of the following values: Any, Client, Downstream, Server, None, or ServerAndClient.

By default, the location parameter has the value Any which is appropriate for most the scenarios. But there are scenarios when you required more control over the cached data.

Suppose you want to cache the logged in use information then you should cache the data on client browser since this data is specific to a user. If you will cache this data on the server, all the user will see the same information that is wrong.

You should cache the data on the server which is common to all the users and is sensitive.

Configure Cache Location

For configuring the cache location, you need to add the System.Web.UI namespace on your controller. You can cached the user's personal information in his browser like as below.

[OutputCache(Duration = 7200, Location = OutputCacheLocation.Client, VaryByParam = "none", NoStore = true)]
public ActionResult Index()
{
 ViewBag.Message = "Welcome : " + User.Identity.Name;
 return View();
}

What do you think?

I hope you have got what is caching and how it works. I would like to have feedback from my blog readers. Your valuable feedback, question, or comments about this article are always welcome.

CRUD Operations using jQuery dialog, Entity Framework and ASP.NET MVC

This article will demonstrate, how to create an Asp.Net MVC application with CRUD (Create, Read, Update, Delete) Operations using jQuery and Entity Framework code first. suppose you have following data model and DataContext classes in EF.

 public class User
 {
 public int UserID { get; set; }
 [Required(ErrorMessage = "Please Enter Your Name")]
 public string Name { get; set; }
 [Required(ErrorMessage = "Please Enter Your Address")]
 public string Address { get; set; }
 [Required(ErrorMessage = "Please Enter Your Contact No")]
 public string ContactNo { get; set; }
 }
 
public class DataContext : DbContext
 {
 public DataContext()
 : base("DefaultConnection")
 {
 
 }
 
 public DbSet<User> Users { get; set; }
 }

Now migrate your data model class into SQL Server database by using EF code first database migration. For more help refer this link Understanding Entity Framework Code First Migrations

Create Operation

Read Operation

Update Operation

Delete Operation

Making jQuery dialogs for CRUD Operations

 @model IEnumerable<jQuery_CRUD.DAL.User>
@{
 ViewBag.Title = "Index";
}
<script src="~/Scripts/jquery-1.8.2.min.js"></script>
<script src="~/Scripts/jquery-ui-1.8.24.min.js"></script>
<link href="~/Content/themes/base/jquery-ui.css" rel="stylesheet" />
<script>
 $(document).ready(function () {
 var url = "";
 $("#dialog-alert").dialog({
 autoOpen: false,
 resizable: false,
 height: 170,
 width: 350,
 show: { effect: 'drop', direction: "up" },
 modal: true,
 draggable: true,
 open: function (event, ui) {
 $(".ui-dialog-titlebar-close").hide();
 },
 buttons: {
 "OK": function () {
 $(this).dialog("close");
 
 },
 "Cancel": function () {
 $(this).dialog("close");
 }
 }
 });
 
 if ('@TempData["msg"]' != "") {
 $("#dialog-alert").dialog('open');
 }
 
 $("#dialog-edit").dialog({
 title: 'Create User',
 autoOpen: false,
 resizable: false,
 width: 400,
 show: { effect: 'drop', direction: "up" },
 modal: true,
 draggable: true,
 open: function (event, ui) {
 $(".ui-dialog-titlebar-close").hide();
 $(this).load(url);
 }
 });
 
 $("#dialog-confirm").dialog({
 autoOpen: false,
 resizable: false,
 height: 170,
 width: 350,
 show: { effect: 'drop', direction: "up" },
 modal: true,
 draggable: true,
 open: function (event, ui) {
 $(".ui-dialog-titlebar-close").hide();
 
 },
 buttons: {
 "OK": function () {
 $(this).dialog("close");
 window.location.href = url;
 },
 "Cancel": function () {
 $(this).dialog("close");
 }
 }
 });
 
 $("#dialog-detail").dialog({
 title: 'View User',
 autoOpen: false,
 resizable: false,
 width: 400,
 show: { effect: 'drop', direction: "up" },
 modal: true,
 draggable: true,
 open: function (event, ui) {
 $(".ui-dialog-titlebar-close").hide();
 $(this).load(url);
 },
 buttons: {
 "Close": function () {
 $(this).dialog("close");
 }
 }
 });
 
 $("#lnkCreate").live("click", function (e) {
 //e.preventDefault(); //use this or return false
 url = $(this).attr('href');
 $("#dialog-edit").dialog('open');
 
 return false;
 });
 
 $(".lnkEdit").live("click", function (e) {
 // e.preventDefault(); use this or return false
 url = $(this).attr('href');
 $(".ui-dialog-title").html("Update User");
 $("#dialog-edit").dialog('open');
 
 return false;
 });
 
 $(".lnkDelete").live("click", function (e) {
 // e.preventDefault(); use this or return false
 url = $(this).attr('href');
 $("#dialog-confirm").dialog('open');
 
 return false;
 });
 
 $(".lnkDetail").live("click", function (e) {
 // e.preventDefault(); use this or return false
 url = $(this).attr('href');
 $("#dialog-detail").dialog('open');
 
 return false;
 });
 
 $("#btncancel").live("click", function (e) {
 $("#dialog-edit").dialog("close");
 return false;
 });
 });
</script>
<div id="dialog-alert" style="display: none">
 <p>
 @TempData["msg"]!
 </p>
</div>
 
<div id="dialog-confirm" style="display: none">
 <p>
 <span class="ui-icon ui-icon-alert" style="float: left; margin: 0 7px 20px 0;"></span>
 Are you sure to delete?
 </p>
</div>
 
<div id="dialog-edit" style="display: none">
</div>
<div id="dialog-detail" style="display: none">
</div>
 
<h2>Users List</h2>
 
<p>
 @Html.ActionLink("Create New", "Create", null, new { id = "lnkCreate" })
</p>
<table>
 <tr>
 <th>
 @Html.DisplayNameFor(model => model.Name)
 </th>
 <th>
 @Html.DisplayNameFor(model => model.Address)
 </th>
 <th>
 @Html.DisplayNameFor(model => model.ContactNo)
 </th>
 <th></th>
 </tr>
 
 @foreach (var item in Model)
 {
 <tr>
 <td>
 @Html.DisplayFor(modelItem => item.Name)
 </td>
 <td>
 @Html.DisplayFor(modelItem => item.Address)
 </td>
 <td>
 @Html.DisplayFor(modelItem => item.ContactNo)
 </td>
 <td>
 @Html.ActionLink("Edit", "Edit", new { id = item.UserID }, new { @class = "lnkEdit" }) |
 @Html.ActionLink("Details", "Details", new { id = item.UserID }, new { @class = "lnkDetail" }) |
 @Html.ActionLink("Delete", "Delete", new { id = item.UserID }, new { @class = "lnkDelete" })
 </td>
 </tr>
 }
 
</table>

Controller for handling CRUD Operations

 public class UserController : Controller
 {
 private DataContext db = new DataContext();
 
 // GET: /User/
 public ActionResult Index()
 {
 return View(db.Users.ToList());
 }
 
 // GET: /User/Details/5
 public ActionResult Details(int id = 0)
 {
 User user = db.Users.Find(id);
 if (user == null)
 {
 return HttpNotFound();
 }
 return View(user);
 }
 
 // GET: /User/Create
 public ActionResult Create()
 {
 return PartialView();
 }
 
 // POST: /User/Create
 [HttpPost]
 [ValidateAntiForgeryToken]
 public ActionResult Create(User user, string Command)
 {
 if (ModelState.IsValid)
 {
 db.Users.Add(user);
 db.SaveChanges();
 TempData["Msg"] = "Data has been saved succeessfully";
 return RedirectToAction("Index");
 }
 
 return View(user);
 }
 
 // GET: /User/Edit/5
 public ActionResult Edit(int id = 0)
 {
 User user = db.Users.Find(id);
 if (user == null)
 {
 return HttpNotFound();
 }
 return View(user);
 }
 
 // POST: /User/Edit/5
 [HttpPost]
 [ValidateAntiForgeryToken]
 public ActionResult Edit(User user)
 {
 if (ModelState.IsValid)
 {
 db.Entry(user).State = EntityState.Modified;
 db.SaveChanges();
 TempData["Msg"] = "Data has been updated succeessfully";
 return RedirectToAction("Index");
 }
 return View(user);
 }
 
 // GET: /User/Delete/5
 public ActionResult Delete(int id)
 {
 User user = db.Users.Find(id);
 db.Users.Remove(user);
 db.SaveChanges();
 TempData["Msg"] = "Data has been deleted succeessfully";
 return RedirectToAction("Index");
 }
 
 protected override void Dispose(bool disposing)
 {
 db.Dispose();
 base.Dispose(disposing);
 }
 }

What do you think?

I hope you will enjoy these tricks while programming with ASP.NET MVC. I would like to have feedback from my blog readers. Your valuable feedback, question, or comments about this article are always welcome.