Pro ASP.NET MVC 3 Framework

837 Pages·2016·11.23 MB·English

by  Freeman A.

For your convenience Apress has placed some of the front
matter material after the index. Please use the Bookmarks
and Contents at a Glance links to access them.
Contents at a Glance
■About the Authors...................................................................................................xxiii
■About the Technical Reviewer................................................................................xxiv
■Acknowledgments...................................................................................................xxv
■Part 1: Introducing ASP.NET MVC 3.............................................................................1
■Chapter 1: What’s the Big Idea?..................................................................................3
■Chapter 2: Getting Ready...........................................................................................17
■Chapter 3: Your First MVC Application......................................................................31
■Chapter 4: The MVC Pattern......................................................................................63
■Chapter 5: Essential Language Features...................................................................89
■Chapter 6: Essential Tools for MVC.........................................................................125
■Chapter 7: SportsStore: A Real Application.............................................................155
■Chapter 8: SportsStore: Navigation and Cart ..........................................................195
■Chapter 9: SportsStore: Administration..................................................................249
■Part 2: ASP.NET MVC 3 in Detail..............................................................................301
■Chapter 10: Overview of MVC Projects....................................................................303
■Chapter 11: URLs, Routing, and Areas.....................................................................325
■Chapter 12: Controllers and Actions........................................................................385
■Chapter 13: Filters...................................................................................................427
■Chapter 14: Controller Extensibility.........................................................................461
■Chapter 15: Views ...................................................................................................493
iv
■Chapter 16: Model Templates..................................................................................543
■Chapter 17: Model Binding......................................................................................577
■Chapter 18: Model Validation..................................................................................601
■Chapter 19: Unobtrusive Ajax..................................................................................647
■Chapter 20: jQuery...................................................................................................673
■Part 3: Delivering Successful ASP.NET MVC 3 Projects...........................................709
■Chapter 21: Security and Vulnerability....................................................................711
■Chapter 22: Authentication and Authorization........................................................731
■Chapter 23: Deployment..........................................................................................761
■Index........................................................................................................................793
v
v
P A R T I

■ ■ ■

Introducing ASP.NET MVC 3
ASP.NET MVC Framework is a radical shift for web developers using the Microsoft platform. It
emphasizes clean architecture, design patterns, and testability, and it doesn’t try to conceal how the
Web works.
The first part of this book is designed to help you understand the foundational ideas of the ASP.NET
MVC Framework, including the new features in ASP.NET MVC 3, and to experience in practice what the
framework is like to use.

1
C H A P T E R 1

■ ■ ■

What’s the Big Idea?
ASP.NET MVC is a web development framework from Microsoft that combines the effectiveness and
tidiness of model-view-controller (MVC) architecture, the most up-to-date ideas and techniques from
agile development, and the best parts of the existing ASP.NET platform. It’s a complete alternative to
traditional ASP.NET Web Forms, delivering considerable advantages for all but the most trivial of web
development projects. In this chapter, you’ll learn why Microsoft originally created ASP.NET MVC, how
it compares to its predecessors and alternatives, and finally, what’s new in ASP.NET MVC 3.
A Brief History of Web Development
To understand the distinctive aspects and design goals of ASP.NET MVC, it’s worth considering the
history of web development so far—brief though it may be. Over the years, Microsoft’s web development
platforms have demonstrated increasing power, and unfortunately, increasing complexity. As shown in
Table 1-1, each new platform tackled the specific shortcomings of its predecessor.
Table 1-1. Microsoft’s Lineage of Web Development Technologies
Period Technology Strengths Weaknesses
Jurassic Common Gateway Simple Runs outside the web server, so is
Interface (CGI)* resource-intensive (spawns a separate
Flexible
operating system process per request)
Only option at the
Low-level
time
Bronze Microsoft Internet Runs inside web Just a wrapper for SQL queries and
age Database Connector server templates for formatting result sets
(IDC)
1996 Active Server Pages General purpose Interpreted at runtime
(ASP)
Encourages “spaghetti code”
Continued
3
CHAPTER 1 ■ WHAT’S THE BIG IDEA?

Period Technology Strengths Weaknesses
2002/03 ASP.NET Web Forms Compiled Heavy on bandwidth
1.0/1.1
“Stateful” UI Ugly HTML
Vast infrastructure Untestable

Encourages object-
oriented
programming
2005 ASP.NET Web Forms
2.0
2007 ASP.NET AJAX
2008 ASP.NET Web Forms
3.5
2009 ASP.NET MVC 1.0
2010 ASP.NET MVC 2.0
ASP.NET Web Forms
4.0
2011 ASP.NET MVC 3.0
*CGI is a standard means of connecting a web server to an arbitrary executable program that returns
dynamic content. The specification is maintained by the National Center for Supercomputing
Applications (NCSA).
4
CHAPTER 1 ■ WHAT’S THE BIG IDEA?

Traditional ASP.NET Web Forms
ASP.NET was a huge shift when it first arrived in 2002. Figure 1-1 illustrates Microsoft’s technology stack
as it appeared then.

Figure 1-1. The ASP.NET Web Forms technology stack
With Web Forms, Microsoft attempted to hide both HTTP (with its intrinsic statelessness) and
HTML (which at the time was unfamiliar to many developers) by modeling the user interface (UI) as a
hierarchy of server-side control objects. Each control kept track of its own state across requests (using
the View State facility), rendering itself as HTML when needed and automatically connecting client-side
events (for example, a button click) with the corresponding server-side event handler code. In effect, Web
Forms is a giant abstraction layer designed to deliver a classic event-driven graphical user interface (GUI)
over the Web.
The idea was to make web development feel just the same as Windows Forms development.
Developers no longer needed to work with a series of independent HTTP requests and responses; we
could now think in terms of a stateful UI. We could forget about the Web and its stateless nature, and
instead build UIs using a drag-and-drop designer, and imagine—or at least pretend—that everything
was happening on the server.
5
CHAPTER 1 ■ WHAT’S THE BIG IDEA?

What’s Wrong with ASP.NET Web Forms?
Traditional ASP.NET Web Forms development was a great idea, but reality proved more complicated.
Over time, the use of Web Forms in real-world projects highlighted some shortcomings:
• View State weight: The actual mechanism for maintaining state across requests
(known as View State) results in large blocks of data being transferred between the
client and server. This data can reach hundreds of kilobytes in even modest web
applications, and it goes back and forth with every request, frustrating site visitors
with slower response times and increasing the bandwidth demands of the server.
• Page life cycle: The mechanism for connecting client-side events with server-side
event handler code, part of the page life cycle, can be extraordinarily complicated
and delicate. Few developers have success manipulating the control hierarchy at
runtime without getting View State errors or finding that some event handlers
mysteriously fail to execute.
• False sense of separation of concerns: ASP.NET’s code-behind model provides a
means to take application code out of its HTML markup and into a separate code-
behind class. This has been widely applauded for separating logic and
presentation, but in reality, developers are encouraged to mix presentation code
(for example, manipulating the server-side control tree) with their application
logic (for example, manipulating database data) in these same monstrous code-
behind classes. The end result can be fragile and unintelligible.
• Limited control over HTML: Server controls render themselves as HTML, but not
necessarily the HTML you want. Prior to ASP.NET 4, the HTML output usually
failed to comply with web standards or make good use of Cascading Style Sheets
(CSS), and server controls generated unpredictable and complex ID values that are
hard to access using JavaScript. These problems are reduced in ASP.NET 4, but it
can still be tricky to get the HTML you expect.
• Leaky abstraction: Web Forms tries to hide away HTML and HTTP wherever
possible. As you try to implement custom behaviors, you frequently fall out of the
abstraction, which forces you to reverse-engineer the postback event mechanism
or perform obtuse acts to make it generate the desired HTML. Plus, all this
abstraction can act as a frustrating barrier for competent web developers.
• Low testability: The designers of ASP.NET could not have anticipated that
automated testing would become an essential component of software
development. Not surprisingly, the tightly coupled architecture they designed is
unsuitable for unit testing. Integration testing can be a challenge, too.

ASP.NET has kept moving. Version 2.0 added a set of standard application components that can
reduce the amount of code you need to write yourself. The AJAX release in 2007 was Microsoft’s
response to the Web 2.0/AJAX frenzy of the day, supporting rich client-side interactivity while keeping
developers’ lives simple. The most recent release, ASP.NET 4, produces more predictable and standards-
compliant HTML markup, but many of the intrinsic limitations remain.
6
CHAPTER 1 ■ WHAT’S THE BIG IDEA?

Web Development Today
Outside Microsoft, web development technology has been progressing rapidly and in several different
directions since Web Forms was first released. Aside from AJAX, there have been other major
developments.
Web Standards and REST
The drive for web standards compliance has increased in recent years. Web sites are consumed on a
greater variety of devices and browsers than ever before, and web standards (for HTML, CSS, JavaScript,
and so forth) remain our one great hope for enjoying a decent browsing experience everywhere—even
on the Internet-enabled refrigerator. Modern web platforms can’t afford to ignore the business case and
the weight of developer enthusiasm for web standards compliance.
At the same time, Representational State Transfer (REST) has become the dominant architecture for
application interoperability over HTTP, completely overshadowing SOAP (the technology behind
ASP.NET’s original approach to web services). REST describes an application in terms of resources
(URIs) representing real-world entities and standard operations (HTTP methods) representing available
operations on those resources. For example, you might PUT a new http://www.example.com/
Products/Lawnmower or DELETE http://www.example.com/Customers/Arnold-Smith.
Today’s web applications don’t serve just HTML; often they must also serve JSON or XML data to
various client technologies including AJAX, Silverlight, and native smartphone applications. This
happens naturally with REST, which eliminates the historical distinction between web services and web
applications—but requires an approach to HTTP and URL handling that has not easily been supported
by ASP.NET Web Forms.
Agile and Test-Driven Development
It is not just web development that has moved on in the last decade—software development as a whole
has shifted towards agile methodologies. This can mean a lot of different things, but it is largely about
running software projects as adaptable processes of discovery, resisting the encumbrance and
restrictions of excessive forward planning. Enthusiasm for agile methodologies tends to go hand-in-
hand with a particular set of development practices and tools (usually open source) that promote and
assist these practices.
Test-driven development (TDD), and its latest incarnation, behavior-driven development (BDD), are
two obvious examples. The idea is to design your software by first describing examples of desired
behaviors (known as tests or specifications), so at any time, you can verify the stability and correctness of
your application by executing your suite of specifications against the implementation. There’s no
shortage of .NET tools to support TDD/BDD, but these tend not to work well with Web Forms:
• Unit testing tools let you specify the behavior of individual classes or other small
code units in isolation. These can be effectively applied only to software that has
been designed as a set of independent modules, so that each test can be run in
isolation. Unfortunately, few Web Forms applications can be tested this way.
Following the framework’s guidance to put logic into event handlers or even use
server controls that directly query databases, developers typically end up tightly
coupling their own application logic to the Web Forms runtime environment. This
is death for unit testing.
7