Fixing asp.net MVC AuthorizeAttribute

With very little code we can fix asp.net MVC AuthorizeAttribute
What problems does it have? Too much redirection.

• When making ajax calls a HTTP 401 (Unauthorized) would be better than a redirection
• If I am already logged in but access a secure resource (controller / action) redirecting to the login page is far from ideal, an access denied view makes more sense

When is the built in redirection appropriate? When making standard HTTP request and the user is not authenticated.

it turns out it is relatively easy to fix these issues

• inherit AuthorizeAttribute
• override HandleUnauthorizedRequest

#1: Ajax request should not return redirection / html response

if the user cannot authorize an action and the request is made via ajax we don't want 200 or 302 response codes

we do want 401 Unauthorized, but we have to settle for a 403 Forbidden

The code to fix this

#2: Authenticated users should not redirect to the login page, they should get an Access Denied page

The code to fix this

Turns out very little code is needed - but seems like some of this should just be built in? Using the 401 response won't work because the asp mvc framework must be picking that up later on and forcing the redirection to the login page, the 403 is not ideal but it is effective.

The code for our class - AuthorizeFor

Usage of our AuthorizeFor attribute

Resources

• MSDN AuthorizeAttribute
• Stack Overflow post about the 401 403 issue

asp mvc jquery from cdn with fallback to localhost

Paul Irish has some nice code for loading jquery from cdn but then falling back to localhost if it cannot be loaded from cdn. Check it out here.

For asp mvc you usually also want jquery.valdiater and possibly unobtrusive validation as well. Here is an html helper to generate html mark up that handles loading these via cdn with fallback

The helper



Usage, most likely from your layout file



And the rendered html

ASP MVC Razor templates with nested layout and sections

Using ASP MVC 3 with Razor views.

Ran into an issue with nested layouts and wanting to render a section in a top level layout, but define it in the view which uses a 'child' layout (master) page. This was generating a runtime error of:

The following sections have been defined but have not been rendered for the layout page... 

I posted some code to the asp.net forum and github. A nice workaround was supplied by 'Imran Baloch'

• Sample code at github
• Forum Post over at asp.net forums

The best overload for 'RenderSection' does not have a parameter named 'optional'

I've been taking a look at asp.net mvc 3 beta with razor view templates.

some of the examples on the net are from previous releases and things have changed; one that I came across was the RenderSection method which can be used in layout (master) files

@RenderSection("Header", optional:true)

will throw an exception

The best overload for 'RenderSection' does not have a parameter named 'optional'

the newer syntax for rendering an optional section appears to be

@RenderSection("Header", false) 

Python MVC web framework - web2py

Recently I did a google search for a Python MVC web framework. I have never done any coding in Python but it seems to be one of the primary languages used at Google and currently the only language supported on the Google App Engine so it seemed worth getting familiar with.

Django seems to be one of the most robust python mvc frameworks around at this time and I was going to dive in and create a small toy application with it, but then I stumbled across a comment on some blog that talked about the web2py MVC framework, still in it's infancy, development is very active on the project. It seems very easy to get up to speed with the framework and even someone who does not know Python can get a simple site up and running.

I love this graphic from one of the pdfs on the site

The feature list taken directly from the site

• No installation, no configuration, no dependencies. All in one package. You can run it off a USB drive
• Runs on Windows, OSX, Unix/Linux, and Windows CE phones.
• Allows development, debugging, testing, deployment, maintenance and administration, including database administration, via the provided web interface.
• Enforces good Software Engineer practices, like the Model-View-Controller design, validation and self-submission of forms.
• Strong on security. Prevents the most common types of vulnerabilities: Cross Site Scripting, Injection Flaws, and Malicious File Execution.
• Talks HTML, XML, RSS, ATOM, AJAX, JSON, RTF, CSV, WIKI, XML-RPC, REST, Flash, etc.
• Dynamically and transparently generates SQL queries for you for SQLite, MySQL, PostgreSQL and Oracle. Even creates and alters tables for you when required. Performs automatic transactions.
• Allows you to create apps easily, byte-code compile them, and distribute them in open or closed source under any license you like.
• Faster then the competition, designed for small as well as large projects, includes the ability to upload/download/stream large files, internationalization support, distributed transactions, ...

Web2py is worth checking out!

.