Configuring an ASP.net Application

1
Session 14
Configuring an ASP.net Application
2
Session Objectives

• Discuss

• Machine.Config

• Web.Config

• Structure of a configuration file

• Secure your web pages using Authentication

3
Web Pages Web Application
Web Page
Web Page
Web Page
WEB APPLICATION
Web Page
Web Page --------- ---------
4
Configuration Files
ltconfigurationgt ltsystem.webgt ltsessionState
timeout10 /gt lt/system.webgt lt/configurationgt

• Stored in plain text format

Tag and attribute names

• Written in XML. Rules for
• naming tags and attributes

Attribute values

• No need to restart server in case of changes to
  file

F E A T U R E S

• Each directory can have its own file

• Each directory overrides earlier configuration
  file

• Clients cannot view the file from browser

5
Types of Configuration Files - 1
Machine.config

• Settings are applied to all the applications
  residing on the server

Build number of .net CLR

• XML based file

• Stored in C\WinNT\Microsoft.NET\Framework\v.1.x
  xxx\config

• Only one file per ASP.net installation on a
  machine

Web.config

• Settings are applied to single application
  residing on the server

• XML based file

• One file per each directory of the web
  application

6
Types of Configuration Files - 2

• One per machine

Web Applications

• One per application
• Override settings of machine.config

7
Typical Web.config File
Configuration section Handler Declaration Area
ltconfigurationgt ltconfigSectionsgt ltsection
name"sectionSettings" type"Class" /gt
ltsectionGroup name"sectionGroup"gt ltsection
name"sectionSettings" type"Class" /gt
lt/sectionGroupgt lt/configSectionsgt ltsection
namesectionSettings typeltClassgt /gt
ltsectionGroupgt ltsectionSettings
attribute"someValue" /gt ltsectionSettings
SomeAttributeSomeValuegt ltelement
attributevaluegt lt/sectionSettingsgt
lt/sectionGroupgt lt/configurationgt
Configuration section Settings Area
8
Page Configuration Setting
Response to the client can be buffered
ltconfigurationgt ltsystem.webgt ltpages
bufferfalse enableViewStatetrue
/gt lt/system.webgt lt/configurationgt
View state can be set
9
Application Setting
Configuration settings in form of key-value pair
ltconfigurationgt ltappSettingsgt ltadd
keyMyQuery valueSelect FROM MyTable/gt
lt/appSettingsgt lt/configurationgt
The settings are read in ASP.NET page
... String GetQuery Configuration.AppSettings(M
yQuery) ...
10
Compilation Setting
Specifies whether to compile retail binaries or
debug binaries.
ltconfigurationgt ltsystem.webgt ltcompilation
debug"true" defaultLanguageC/gt
lt/system.webgt lt/configurationgt
Provides a semicolon-separated list of language
names to use in dynamic compilation of files
11
Sub-tags of Compilation tag -1
1
ltassembliesgt sub-tag
add
remove
clear
ltconfigurationgt ltsystem.webgt ltcompilation
debug"true" defaultLanguageC/gt  
ltassembliesgt ltadd assembly"System.Net" /gt
lt/assembliesgt lt/system.webgt lt/configurationgt
12
Sub-tags of Compilation tag - 2
ltnamespacesgt sub-tag
2
ltconfigurationgt ltsystem.webgt
ltcompilation debug"true" defaultLanguageC/
gt   ltnamespacesgt ltadd namespace"System.We
b.UI" /gt lt/namespacesgt lt/system.webgt lt/configur
ationgt
ltcompilersgt sub-tag
3
13
customErrors Setting
ltcustomErrors defaultRedirect"url"
mode"OnOffRemoteOnly"gt lterror
statusCode"statuscode" redirect"url/gt lt/customE
rrorsgt
Syntax
ltconfigurationgt ltsystem.webgt
ltcustomErrors defaultRedirect"http//
localhost/allError.aspx"
mode"RemoteOnly"gt lterror
statusCode"404" redirecthttp//lo
calhost/Error404.aspx"/gt
lt/customErrorsgt lt/system.webgt lt/configurationgt
Example
14
Authentication and Authorization -1
ltconfigurationgt ltsystem.webgt
ltauthentication mode"WindowsFormsPassportNone"
gt  ltforms name"name" loginUrl"url"
protection"AllNoneEncryption
" timeout"xx" path"/" gt 
ltcredentials passwordFormat"Clear
SHA1MD5"gt ltuser
name"username" password"password" /gt
lt/credentialsgt
lt/formsgt  ltpassport redirectUrl"intern
al"/gt  lt/authenticationgt
lt/system.webgt lt/configurationgt
15
Authentication and Authorization - 2
Authentication Type
Description
Windows
Windows authentication as default authentication
mode. Used for any form of IIS authentication
ASP.NET forms-based authentication as default
authentication mode
Forms
Microsoft Passport authentication as default
authentication mode
Passport
No authentication. Used by anonymous users and
applications providing own authentication
None
16
Attributes of ltformsgt tag
Attribute Option Description
Name None Cookie name used for authentication
LoginUrl None Login page URL. The client is redirected to this URL if no authentication cookie
protection ALL Application uses both data validation and encryption to protect the cookie.
protection None Both encryption and validation are disabled
timeout The amount of time, in minutes, after which the authentication cookie expires. Default value is 30.
path Path for cookies issued by the application. Default value is a backslash (/)
17
Forms Authentication
ltconfigurationgt ltsystem.webgt
ltauthentication mode"Forms"gt ltforms
name"form1" loginUrl"login.aspx"
protection"None" timeout"60"gt  
ltcredentials passwordFormat"Clear"gt ltuser
name"zeal" password"SaysYahoo"/gt ltuser
name"scooby" password"doo"/gt ltuser
name"cow" password"moo"/gt
lt/credentialsgt   lt/formsgt lt/authenticationgt
lt/system.webgt lt/configurationgt  
18
Authorization
ltconfigurationgt ltsystem.webgt
ltauthentication mode"Forms"gt ltforms
name"form1 loginUrl"login.aspx"
protection"None" timeout"60"gt   ltcredentials
passwordFormat"Clear"gt ltuser name"zeal"
password"SaysYahoo"/gt ltuser name"scooby"
password"doo"/gt ltuser name"cow"
password"moo"/gt lt/credentialsgt   lt/formsgt
lt/authenticationgt ltauthorizationgt ltallow
usersscooby, cow /gt ltdeny userszeal
/gt lt/authorizationgt lt/system.webgt lt/configuratio
ngt