ASP.NET 2.0 Visual Web Developer 2005 Express Edition Starter Kit (2006)

Chapter 9

9.From the page-content folder, open Web.Config.txt, and copy the contents (the siteMap section).

10.Open Web.config, and underneath the </authentication> element, paste the code you copied from Web.Config.txt.

11.Save the file and run the application. Notice that the Admin item is now not shown on the menu.

12.Login as Dave (using dave@123), and you see that the Admin item still isn’t shown. Log out, and log in as Alex (using alex@123), and notice that the Admin item appears.

Let’s see how this works.

How It Works

The first thing you did was to add a new siteMapNode to the menus structure. This adds the Admin item to the bottom of the menu.

<siteMapNode url=”Admin.aspx” title=”Admin” description=”Edit Pizzas” />

You then added a LoginView control to the master page, and this is a clever control. When you are not logged into the site, the LoginView control shows a Login link. When you click this link, you are redirected to the login page (the login page you defined earlier in the chapter) with the loginUrl attribute on the login element in the authentication section. Once you have logged in, the LoginView control shows a Logout link, which, when clicked, will log you out of the site.

You then ran the application and used the LoginView to log into, and out of, the site, but noticed that the Admin link was shown no matter who you logged in as. This is because, by default, the menu system doesn’t apply any security. To correct that, you modified the Web configuration file, and a sitemap element:

<siteMap defaultProvider=”AspXmlSiteMapProvider” enabled=”true”> <providers>

<clear/>

<add name=”AspXmlSiteMapProvider” type=”System.Web.XmlSiteMapProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a”

siteMapFile=”web.sitemap” securityTrimmingEnabled=”true”/> </providers>

</siteMap>

You don’t need to know what all of this means, except for the securityTrimmingEnabled attribute, which is the key to the menu security. When securityTrimmingEnabled is set to True, the menu system will check the authorization for each page before displaying it. When logged in as Dave, the menu system checks each page before showing it, and Dave isn’t authorized to access the Admin page, so it isn’t shown on the menu. Alex is authorized, so the page is shown on the menu.

Once again this shows the power of the security system in ASP.NET, and how you can easily add power to your Web sites with very little effort. Let’s now see how we can use the security system from code, to help the checkout page.

274

Security and Deployment

1.Open Checkout.aspx, and double-click anywhere on the page, outside of the Content control. This will open the code file, and create the Page_Load event.

2.Into the event procedure, add the following code:

If Not Page.IsPostBack Then

If User.Identity.IsAuthenticated Then Dim rbl As RadioButtonList = _

DirectCast(Wizard1.FindControl(“RadioButtonList1”), RadioButtonList) rbl.Items.Add(New ListItem(“Charge my account”, “Account”))

End If End If

3.Save the file and run the application.

4.Navigate to the checkout page, and step into the Payment step. Notice how the payment options list shows only two items.

5.Log in to the site. Repeat step 4, and notice how there are now three items on the payment options list.

Let’s see how this works.

How It Works

You added code to the Page_Load event, which will run whenever the page is loaded. The first line checks to see if the IsPostBack property of the Page is set. If it is, then a button or link on the page has been clicked, and it isn’t the first time the page is loaded. If the IsPostBack is not set, then it is the first time the page has loaded, so further code is to be run.

If Not Page.IsPostBack Then

You then use the Membership service from code, starting with the User class, which identifies the current user. The User class has an Identity property, which gives further details about the user, and one of those further details is the IsAuthenticated property. If this is set, then the user is authenticated (that is, logged into the site).

If User.Identity.IsAuthenticated Then

Next, you obtained a reference to the RadioButtonList control that shows the payment method.

Dim rbl As RadioButtonList = _ DirectCast(Wizard1.FindControl(“RadioButtonList1”), RadioButtonList)

You then add a new ListItem to the RadioButtonList, with a Text value of Charge my account, and a Value of Account.

rbl.Items.Add(New ListItem(“Charge my account”, “Account”)) End If

End If

275

Chapter 9

That’s all there is to the code. When the page first loads, you check to see if the user is logged in. ASP.NET provides a User object, which has a property called Identity, and this identifies the user. A property of the Identity object, IsAuthenticated, tells us whether or not the user has been authenticated (that is, if they have logged in). If the user is logged in, you add another option to the list, which you could then use in the final stage of the payment to charge the user’s account.

That’s the end of modifying the pages, so let’s now look at how you can transfer this site to a Web server.

Publishing a Site

When using VWD, you have a built-in way to run the Web pages. But for live Web sites, you need a public Web server, and these are managed either by your company or by a service provider. To make your site available, you need to copy it to the target Web server, and there is a utility provided within VWD to help you with it.

This utility is available from the Copy Web Site . . . option from the Website menu, which shows the Copy Web page (see Figure 9-9)

Figure 9-9: The initial Copy Web page

276

Security and Deployment

To pick the target site, select the “Connect to . . .” option, which shows the Open Web Site window. You have the option of copying to a folder, a Web server (Local IIS), an FTP Site, or a Web site using HTTP (Remote Site). Figure 9-10 shows connecting to an FTP site.

Figure 9-10: The Open Web Site page

Once connected, you can see the files from the local site on the left, with the files from the remote site on the right, and you have options to copy between the two sites. For example, Figure 9-11 shows uploading files to a remote Web site using the FTP option.

277

Chapter 9

Figure 9-11: Uploading files to a Web site

The Copy Web feature allows copying both ways, so if you’ve mistakenly deleted some files from the local site, you can always fetch them from the remote site.

Summar y

This chapter has covered two major topics: security and deployment.

For security, we looked at how you can use the Web Site Configuration Tool to set up security, add users, and set the roles for the users (that is, authentication). We then discussed how to secure Web pages so that only authorized users can access them, both directly and from a menu. This allows you to create pages that only selected users can see, and this aspect, although not covered here, can be extended to parts of a page, so that a page will show different content depending upon the user.

You saw that the security system is extremely simple to set up, with only a few configuration options required to protect a site. Not only can you use the security controls to interact with the Membership service but you can also use code. This brings added flexibility and becomes more useful as you add more code to your sites.

278

Security and Deployment

Finally, we briefly looked at how you can deploy your Web site to a remote location, using the Copy Web tool. This allows you to use a variety of methods to copy sites to public Web servers. There are other ways to deploy applications, but these aren’t built into the tool. The deployment offered in VWD allows for a variety of protocols and covers the basics of what you’ll need to deploy to a remote location.

In all, we’ve covered a lot of ground in this book, but we have really only scratched the surface of what ASP.NET can achieve. You’ve seen how to use databases, how to structure sites using master pages and navigation, how to view and update data in grids, how to create custom classes, and how to implement security. These cover the basics of what you need to construct Web sites and give you good grounding from which to continue your exploration of ASP.NET.

We hope that you’ve enjoyed this book and that you continue to explore both ASP.NET and Visual Web Developer as a means to creating Web sites.

279

.aspx pages (continued)

282

283