Scott Seely's Blog

Validating a WRAP ACS token in node.js

scott.seely@friseton.com (Scott Seely) — Mon, 02 Jan 2012 20:00:48 GMT

A few friends and I are building a system for home automation. Specifically, it is an application that opens and closes a garage door. One of the design decisions was to write the server side in node.js but to use Azure when it made sense. One of the Azure features we are using is the Access Control Service. When a client presents a token, you need to make sure that the signature on that token is valid. That turns out to be fairly interesting if you are new to node.js and have never used it before. I fit that model well. After a lot of tinkering and learning, I was able to write a function that validated a wrap_access_token using node.js and some associated, standard libraries. Here is the code, in its entirety. I include some 'test' code as well to allow others to verify results. I've already rotated the ACS signing key so that I don't breach security too badly This whole thing works surprisingly well.

In case you can't read the code too well, here is what it does:

1. Parse the token into it's constituent parts.

2. Pass the wrap_access_token to the function, along with the associated key.

Within the function:

1. Remove the signature part from the token since we need to verify that we generate the same signature. Since the signature is generated based on the bytes that precede it, the signature can't be part of itself (this part is obvious when you think of it; the hard part is remembering to think of it!)

2. Unescape the signature and remember the base64 version of the signature, which is really just a byte array.

3. Generate the SHA256 HMAC signature using the shared secret/key.

4. Verify that the base64 encoding of the digest that we generated matches the one that was sent it.

5. If the signature passed in matches the one we generated, then the other entity knows the secret and can be trusted to have signed the tokens.

6. Party on, because the claims are valid.

The code would next need to split out the claims. The claims are just form-encoded key value pairs within the wrap_access_token. That step is left as an exercise for the reader.

var crypto = require('crypto');
var util = require('util');
var querystring = require('querystring');
var buffer = require('buffer');

function ValidateToken(token, key){
    var hmacToken = "&HMACSHA256=";
    var indexOfToken = token.indexOf(hmacToken) + hmacToken.length;
    var swtSignature = querystring.unescape(token.substr(indexOfToken, token.length - indexOfToken));
    var signedPiece = token.substr(0, indexOfToken - hmacToken.length);
    var buffer = new Buffer(key, encoding="base64");
    var hmac = crypto.createHmac("sha256", buffer);
    hmac.update(signedPiece);
    var digest = hmac.digest(encoding="base64");
    return digest == swtSignature;
}

var theToken = "wrap_access_token=developersmackdown.garage%3dOpenClose%26http%253a%252f%252fschemas.microsoft.com%252faccesscontrolservice%252f2010%252f07%252fclaims%252fidentityprovider%3dhttps%253a%252f%252ffriseton.accesscontrol.windows.net%252f%26Audience%3dhttp%253a%252f%252fcontosocontacts%252f%26ExpiresOn%3d1325287532%26Issuer%3dhttps%253a%252f%252ffriseton.accesscontrol.windows.net%252f%26HMACSHA256%3dSrgqXJv9pkxjweT2Lr%252bIV%252fGAncqIc34SnbrHdbr3VOQ%253d&wrap_access_token_expires_in=5999";
var theData = querystring.parse(theToken, sep='&', eq='=');
var theKey = "Bn7TfLML5wK+R5TAa2VrO/9JANwuk3lzt/ykc4no+h0=";

util.puts(ValidateToken(theData.wrap_access_token, theKey));

REST Presentation at Chicago Software Development Community in Oakbrook

scott.seely@friseton.com (Scott Seely) — Mon, 07 Nov 2011 08:53:16 GMT

Thanks again to everyone who showed up for my presentation on REST at the Microsoft Store in Oakbrook. I've posted the slides and demos here. It was a great time. I've never presented in a store, never had a component of the "audience" that was just shopping either. It was an interesting, unique experience to say the least! I also enjoyed the conversations afterwards.

My Windows Azure Caching Service talk from DevConnections

scott.seely@friseton.com (Scott Seely) — Wed, 02 Nov 2011 20:30:43 GMT

I just presented my Windows Azure Caching Service talk. Thanks to everyone who attended. The audience was small, but I love that you all asked so many great questions. Here are the slides and demos from the talk. I'll be giving this talk again at the Midwest Cloud Computing User Group in the Chicago area on November 15. You can register for it at http://www.communitymegaphone.com/ShowEvent.aspx?EventID=4709.

The slides and demos from the content at DevConnections is here.

Talk and demos from CNUG, AppFabric Talk

scott.seely@friseton.com (Scott Seely) — Thu, 21 Jul 2011 09:22:48 GMT

Last night I had a chance to speak about Windows Azure AppFabric at the Chicago .NET Users' Group. Thanks to everyone who came out! I had a great time. A few of you really wanted the slides ASAP. I've cleaned out my keys and namespaces from the demos, so they don't run at the moment (but they will build!). You can get them here: https://friseton.blob.core.windows.net/downloads/CNUG-AppFabric-2011-07-20.zip.

You'll need to install a few things and create a few accounts�if you want to run any of the demos:

Tools:

1. Getting started links for Windows Azure: http://www.microsoft.com/windowsazure/learn/getstarted/

2. Windows Azure AppFabric SDK 1.0: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=19925�(for production AppFabric)

3. Windows Azure AppFabric SDK 2.0: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=17691�(for the CTP bits: queues, topics, etc.)

4. More training on Windows Azure: https://www.pluralsight-training.net/microsoft/OLT/subscribe/Subscribe1.aspx?freetrial=true&planHint=Monthly�(10 day free trial-- totally worth it, but I am an instructor there too;) )

AppFabricLabs and the ServiceBus

scott.seely@friseton.com (Scott Seely) — Fri, 20 May 2011 05:00:00 GMT

This week, the Windows Azure AppFabricLabs was updated. The major updates are that the Service Bus labs environment now uses v2 of the Access Control Service and topics/queues have been created. This pushes the number of queueing solutions on Azure to 3:

* Queue Storage

* Message Buffer

* Queues

The main difference between the types of storage relates to size and usage patterns. Queue storage allows for messages up to 8 KB in size and is primarily intended for applications running on Azure. The service only accepts one type of credentials, and you probably don't want to share those.

The Message Buffer stores messages of up to 60KB for about a minute. It is great for volatile queues as a short lived rendezvous point for exchanging messages. This service lives on the Service Bus and allows for authentication with the Access Control Service.

The Queues implementation in the Service Bus allows for larger messages (up to 256 KB) which can last for a longer period of time. Interacting with the queue feature is pretty simple. Go to the https://portal.appfabriclabs.com page and allocate a Service Bus namespace. The 'Hello, World' for the queue looks like this:

static void Main(string[] args)
{
  var sbNamespace = "your namespace";
  var credential = TransportClientCredentialBase.

    CreateSharedSecretCredential("owner", "[your key]");
  var uri = ServiceBusEnvironment.CreateServiceUri("https", sbNamespace,

    string.Empty);
  var client = new ServiceBusNamespaceClient(uri, credential);
  var messagingFactory =
    MessagingFactory.Create(ServiceBusEnvironment.CreateServiceUri("sb",

    sbNamespace, string.Empty), credential);
  var queue = client.CreateQueue("demo");
  var queueClient = messagingFactory.CreateQueueClient(queue);
  var sender = queueClient.CreateSender();
  sender.Open();
  sender.Send(BrokeredMessage.CreateMessage("test"));
  sender.Close();
  var receiver = queueClient.CreateReceiver();
  receiver.Open();
  var message = receiver.Receive();
  receiver.Close();
  Console.WriteLine(message.GetBody<string>());
}

Integrating with the Camera in WP7

scott.seely@friseton.com (Scott Seely) — Mon, 16 May 2011 22:06:42 GMT

There has been a small white lie that many people tell when looking at whether or not a WP7 application can directly interact with the camera. The fib looks like this:

You can only access the camera through the CaptureCameraTask. Direct access is not allowed.

It didn't seem right when I heard that, so I did some digging around, looking for ways to find out what is really contained in the phone. Some information is out there, and if you assemble the parts, you wind up with a better view into what managed code can do on the phone. I wrote a post earlier that showed what you need to do in order to make your development environment work better. As a result of that effort, you are going to be able to use the camera in your Windows Phone 7 applications today.

Adding live support for a phone is actually pretty easy. You just need to add some references to the right assemblies, add a little markup to your page, and then write a few lines of code.

References

Go ahead and create a WP7 XAML app. Once you do that, you need to add references to two assemblies that aren't standard issue:

* Microsoft.Phone.InteropServices

* Microsoft.Phone.Media.Extended

Why two assemblies? The first one allows you to work with the second one-nothing more.

Add some markup to display the camera

To work with the camera, live, here is what you do:

1. Add a reference to the Microsoft.Phone.Media.Extended to the page you want to display the camera output to. For example, add the following to the PhoneApplicationPage element:
xmlns:media=
"clr-namespace:Microsoft.Phone;assembly=Microsoft.Phone.Media.Extended"
2. With that in place, you can then put a CameraVisualizer on to your page. A CameraVisualizer displays the content of a camera on to a surface.
<media:CameraVisualizer Name="cameraVisualizer" Visibility="Visible" 
    Margin="64,4,99,26" Height="426" Width="593" />
Hook up the Camera to the Page

In your page's code behind, add a Microsoft.Phone.PhotoCamera and attach it to the CameraVisualizer. You do that by calling SetSource on the visualizer. The code looks like this:
cameraVisualizer.SetSource(_camera);
Doing something with the Camera

From there, you can access methods telling you what is going on with the camera:

* ShutterPressed: Fires when someone presses the camera button.

* ImageSavedToDisk: Fires when the image you just took is saved to disk, passing along the path to the file.

* ThumbnailSavedToDisk: Fires when the thumbnail is saved. This one also has the image path.

When the shutter is pressed, you still need to tell the camera to take the picture. To do this, fire the CaptureImage method on the PhotoCamera instance. You can also do some cool things like set the flash setting, zoom level, and auto focus.

There are a few gotchas with the camera that do make it difficult to work with and show why it wasn't available to all of us when the phone launched. First off, any time you use the control just a little bit 'incorrectly', you will see a COM exception. Second, any time that the visualizer goes off screen then back again, you need to detach any events, then hook them back up again or you will have a bad experience for your users. If you do not handle the pictures being taken in quick succession, you will have issues.

I invite you to play with the camera but be warned-it is a nasty beast to work with and you will spend quite a few cycles fixing weird little bugs. Microsoft never made a general release of this code because the code needed more QA before burning any cycles documenting the feature. They've already announced it will be in better shape for Mango, but if you want to use it now, I've given you enough rope. Have some fun (and don't hang yourself)!!!

Thanks to Jeff Prosise for encouraging me to talk about this. We were chatting in late April at a conference when I was having some fun with a WP7 camera app I had written and he said he wanted to know how I did that.

The Windows Azure AppFabric CTP For May has Shipped

scott.seely@friseton.com (Scott Seely) — Mon, 16 May 2011 21:01:10 GMT

The May 2011 AppFabric updates have shipped. You can get them all from here: http://www.microsoft.com/downloads/en/details.aspx?FamilyID=d89640fc-c552-446e-aead-b1e0d940f31b. Coverage is exploding over at TechEd, Clemens Vasters can finally talk about topics, and it's a grand day. So, many of you will be digging into the source and will want a CHM file that works. The that you download will be blocked from showing Internet content and when you open it, you will see something like this:

If you do see that 'Navigation to the webpage.' message, here is what you'll need to do.

1. Right-click on the CHM file and select 'properties'.

2. On the General tab, there is a button WAAAAAAYYYYYYY at the bottom labeled Unblock. Click that button so that the content from the Internet will display just fine on your PC.

3. Reopen the CHM and you'll be able to actually view things.

Adding the ‘other’ WP7 Libraries to your VS 2010

scott.seely@friseton.com (Scott Seely) — Sun, 08 May 2011 09:46:51 GMT

WARNING: Everything I'm sharing with you is unsupported. You may or may not be able to publish WP7 applications to the Marketplace using these features. The point behind this is to satisfy hackers. This does NOT modify your phone in any way-it just makes it easier to dig into what WP7 already does. If you use these undocumented features, Microsoft may later change these APIs your applications when they choose to document these features or remove them from a future image of your WP7 phone. Microsoft does not promise to keep these APIs alive between WP7 updates. Got it?

I was curious what goodies were on the phone but not available to everyone else. I knew that people had grabbed the OS image and pulled apart the files on it already, so I figured someone had probably hacked that part already. After some searching, I found this: http://thounsell.co.uk/2010/11/avoiding-reflection-adding-the-interopservices-library-to-the-wp7-sdk/. The handy thing here is that Thomas Hounsell also dumped out all the libraries and gave a hint as to how to include these in our own applications. In there, you will find all sorts of goodies. The binaries he provides include EVERYTHING- documented and undocumented. I didn't see complete details on how to wire up the additional, undocumented bits. Here are my extra instructions:

1. Unpack the binaries from here.

2. Copy the dlls to C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Silverlight\v4.0
\Profile\WindowsPhone

3. Run the following commands from a VS 2010 command prompt, running as administrator (line breaks are in the right place, so copy and paste from here should work):

move GAC_CustomMarshalers_v3_7_0_0_cneutral_1.dll CustomMarshalers.dll
move GAC_Microsoft.Phone.InteropServices_v7_0_0_0_cneutral_1.dll Microsoft.Phone.InteropServices.dll
move GAC_Microsoft.Phone.Media.Extended_v7_0_0_0_cneutral_1.dll Microsoft.Phone.Media.Extended.dll

move GAC_Microsoft.ServiceModel.Channels.Mail.WindowsMobile_v3_7_0_0_cneutral_1.dll Microsoft.ServiceModel.Channels.Mail.WindowsMobile.dll

move GAC_Microsoft.ServiceModel.Channels.Mail_v3_7_0_0_cneutral_1.dll Microsoft.ServiceModel.Channels.Mail.dll
move GAC_Microsoft.VisualBasic.SR_v8_1_1_0_cneutral_1.dll Microsoft.VisualBasic.SR.dll
move GAC_Microsoft.VisualBasic_v8_1_1_0_cneutral_1.dll Microsoft.VisualBasic.dll
move GAC_System.Data.DataSetExtensions_v3_7_0_0_cneutral_1.dll System.Data.DataSetExtensions.dll
move GAC_System.Data_v3_7_0_0_cneutral_1.dll System.Data.dll
move GAC_System.Messaging_v3_7_0_0_cneutral_1.dll System.Messaging.dll
move GAC_System.Net.IrDA_v3_7_0_0_cneutral_1.dll System.Net.IrDA.dll
move GAC_System.SR_v3_7_0_0_cneutral_1.dll System.SR.dll
move GAC_System.Web.Services_v3_7_0_0_cneutral_1.dll System.Web.Services.dll
move GAC_System.Windows.debug.resources_v2_0_5_0_cen-US_1.dll System.Windows.debug.resources.dll
move GAC_System.Windows.RuntimeHost_v2_0_5_0_cneutral_1.dll System.Windows.RuntimeHost.dll
sn -Vr CustomMarshalers.dll
sn -Vr Microsoft.Phone.Interop.dll
sn -Vr Microsoft.Phone.InteropServices.dll
sn -Vr Microsoft.Phone.Media.Extended.dll
sn -Vr Microsoft.ServiceModel.Channels.Mail.dll
sn -Vr Microsoft.ServiceModel.Channels.Mail.WindowsMobile.dll
sn -Vr Microsoft.VisualBasic.dll
sn -Vr Microsoft.VisualBasic.SR.dll
sn -Vr System.Data.DataSetExtensions.dll
sn -Vr System.Data.dll
sn -Vr System.Messaging.dll
sn -Vr System.Net.IrDA.dll
sn -Vr System.SR.dll
sn -Vr System.Web.Services.dll
sn -Vr System.Windows.RuntimeHost.dll
del GAC_*.dll

4. From that administrative window, use notepad to open up

C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\Silverlight\v4.0\Profile\WindowsPhone\RedistList\FrameworkList.xml

5. Within the XML add the following lines before the closing tag in the document (and save the file!):

  <File AssemblyName="Microsoft.Phone.InteropServices" Version="7.0.0.0" Culture="neutral" PublicKeyToken="24eec0d8c86cda1e" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="Microsoft.Phone.Media.Extended" Version="7.0.0.0" Culture="neutral" PublicKeyToken="24eec0d8c86cda1e" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="CustomMarshalers" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Data" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="Microsoft.ServiceModel.Channels.Mail.WindowsMobile" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="Microsoft.ServiceModel.Channels.Mail" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="Microsoft.VisualBasic" Version="8.1.1.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="Microsoft.VisualBasic.SR" Version="8.1.1.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Data.DataSetExtensions" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Data" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Messaging" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Net.IrDA" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.SR" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Web.Services" Version="3.7.0.0" Culture="neutral" PublicKeyToken="969db8053d3322ac" ProcessorArchitecture="MSIL" InGac="false" />

   <File AssemblyName="System.Windows.RuntimeHost" Version="2.0.5.0" Culture="neutral" PublicKeyToken="31bf3856ad364e35" ProcessorArchitecture="MSIL" InGac="false" />

And that's pretty much all you need to do in order to get access to the other DLLs within VS 2010.

Rumors of WPF's Death are Greatly Exaggerated

scott.seely@friseton.com (Scott Seely) — Mon, 02 May 2011 22:15:32 GMT

It seems that, over the last several months, people have become convinced that WPF is dead. Having seen the pace of change in previous desktop UX technologies, I think this concern is unfounded. Has the talk about WPF declined since it launched? Of course. Adoption is no longer a concern. Anyone who needs a desktop application knows WPF exists, books and training are available, and the knowledge is out there. Microsoft doesn't really need to work hard here at this point in time. So, why the angst around WPF?

It seems that the fundamental concern is around the fact that many vendors have stopped fighting for the desktop and have resumed the fight at the browser, saying my HTML5 is better than theirs. The desktop war has gone quiet again and Microsoft still owns that platform, so they've visibly shifted investment from the desktop to where the battle is: in browsers and HTML5. That doesn't mean that they've stopped building WPF, or WinForms, or WebForms, or MFC. But, Microsoft has visibly reduced its investment in those areas. The current set of big bets has been expensive: Azure, WP7, XBox, and Bing. A large part of the Azure investment involves moving server platforms to the cloud. That investment is particularly expensive because now everything has to work on premises and in Azure. Microsoft has limited resources and trying to get significantly more desktop functionality in the next several years just doesn't make sense from a fiduciary point of view. The WPF team still lives, it's just smaller than in 2005.

To appreciate the pace of innovation in WPF, take a look at this ScottGu post from 2009: http://weblogs.asp.net/scottgu/archive/2009/10/26/wpf-4-vs-2010-and-net-4-0-series.aspx. �I expect a similar amount of forward momentum in .NET 5 to add Windows 8 features for WPF developers. WPF is now a mature, stable, technology. Like other libraries in .NET, innovation is no longer around building the perfect class library but instead on enhancing the library's usability and utility. The same things are happening in WCF, System.Transactions, System.Net, System.Security, and other namespaces that we never hear about but that we know haven't been abandoned.

As .NET developers, we need to articulate these facts to project sponsors. When they say "I hear WPF is dead" have them look at WPF�and how it has grown. Look at what it does. Explain that�the investment in WPF has declined because the amount of work to get done today is incremental-- support video cards better, add support�to match Windows Shell innovation, improve drawing. The�library is still being enhanced. http://dotnet.uservoice.com/forums/40583-wpf-feature-suggestions/topics/41002-i-suggest-you-/filter/hot�tells the story of what people want�and what is being accepted into the next version of WPF.

If that's not enough, remind the naysayer that even MFC is still being enhanced.

Houston TechFest 2010: Code and Samples from my WCF/RIA Talk

scott.seely@friseton.com (Scott Seely) — Sat, 09 Oct 2010 15:50:01 GMT

I had a great time talking to the folks at the Houston TechFest. Much thanks also to Addison-Wesley for sponsoring my trip to Houston. If you are interested in becoming an technical author, let me know and I can put you in contact with the editors at Addison-Wesley (scott@scottseely.com).

As promised, my slides and code are online: www.scottseely.com/downloads/HoustonTechFest-Seely-WCFRIA.zip.

Let me know if you have any questions about the code, the presentation, or life as an author.

Clean paths with WCF Hosted Workflows

scott.seely@friseton.com (Scott Seely) — Wed, 08 Sep 2010 18:19:39 GMT

I am a big fan of the things added to WCF 4.0. One of those things is the deep integration with ASP.NET routes. Today, I was writing a service in WF and hosting the workflow with WCF. I really didn't like the service URL-yeah, I'm a picky developer who doesn't like exposing implementation details in the URL.

I knew a few things:

1. WF/WCF integration provides a ServiceHostFactory named WorkflowServiceHostFactory for hosting XAMLX files in WCF.

2. WorfklowServiceHostFactory will see CreateServiceHost called with some constructorString plus a bunch of baseAddresses.

3. I wanted the host to work on HTTP only-I don't care about goofy URLs for net.tcp.

4. XAMLX services do not have a runtime defined type- they exist only in XAML.

My goal was to create a new route type, like ServiceRoute, that allowed me to pass in the desired path and the path to the XAMLX to instantiate. After a few minutes of thinking and hacking, I had the following:

public class WorkflowServiceRoute : ServiceRoute
{
  public class HostedWorkflowServiceHostFactory :

    WorkflowServiceHostFactory
  {
    public HostedWorkflowServiceHostFactory(string xamlxPath)
    {
      XamlxPath = xamlxPath;
    }

    string XamlxPath { get; set; }

    public override System.ServiceModel.ServiceHostBase CreateServiceHost(
      string constructorString, Uri[] baseAddresses)
    {
      return base.CreateServiceHost(XamlxPath, baseAddresses);
    }
  }

  public WorkflowServiceRoute(string routePrefix, string xamlxPath)
    : base(routePrefix,

           new HostedWorkflowServiceHostFactory(xamlxPath),

           typeof(object))
  {
  }
}

I'm pretty happy with the succinctness of the class and the fact that it works on the few use cases I have at hand. Requests are directed to the correct locations and integration seems to be just fine. Use of the WorkflowServiceRoute is just:

routes.Add(new WorkflowServiceRoute("helloWorld", "SimpleWorkflow.xamlx"));

Frankly, this is the first implementation I thought to write, and it works. The code size is small. I don't like a few things about it, but I'll live. Things I don't like:

1. Passing typeof(object) to the base constructor from the route seems wrong. The receiver code thinks it needs a reference to the service type at all times. I'm just lying to the ServiceRoute so that I can take advantage of everything good about it.

2. Custom ServiceHost just so the code can remember the path to the XAMLX. This bothers me until I think that this is the same thing that happens with each .SVC or other XAMLX file.

As a benefit, I get URLs that look like this:

http://scottseely-xps/WfHostApp/helloWorld
instead of:

http://scottseely-xps/WfHostApp/SimpleWorkflow.xamlx

This serves as yet another example of how good it is that WCF is super extensible and what a great design decision it was to build WCF on top of the extensibility points instead of along side them.

How JSONP works (and some bits about implementing it in WCF)

scott.seely@friseton.com (Scott Seely) — Sat, 04 Sep 2010 10:49:13 GMT

In the world of the web, we have lots of security concerns. One of the concerns lies with cross site scripting, XSS. From a high level, XSS is any occasion where data is sent from code on a page from one site to another site. The code is usually via JavaScript, though flash and Silverlight are included in the terminology and mitigations. One way around this that is generally viewed as safe is JSON with Padding, aka JSONP. The way JSONP works is this: you pass an HTTP GET request to retrieve a resource from another site which you do not control. The request contains two pieces of information:

1. The resource you want to retrieve.

2. The callback function that should be executed when the resource is returned.

What makes this safe? The callback function is always something that you control. It is assumed that if your callback does bad things, so be it; that problem existed without involving JSONP.

There is a convention around JSONP. The URL that you call needs to understand a querystring parameter named callback, which identifies the function to call when the method returns. How does this work? Assume we have a resource that, when no callback is specified, returns the following when requesting the resource at

http://localhost/WcfJsonp/jsonp/names:

[{"FirstName":"Scott","LastName":"Seely"},

{"FirstName":"Aaron","LastName":"Skonnard"},

{"FirstName":"Matt","LastName":"Milner"}]

With JSONP, we would like a GET of the above data to execute a function on our page named updatePeople. JSONP indicates that we do this with a request for the resource at http://localhost/WcfJsonp/jsonp/names?callback=updatePeople. In so doing, the resource is now returned as:

updatePeople(

[{"FirstName":"Scott","LastName":"Seely"},

{"FirstName":"Aaron","LastName":"Skonnard"},

{"FirstName":"Matt","LastName":"Milner"}]);

This causes the function, updatePeople, to be called as soon as the resource is retrieved.

How does this work? Most of us will use jQuery to get the job done and not think about things. But, without jQuery, JSONP is still possible. I'll first show you how this works by hand, then with jQuery. jQuery eliminates a number of potential bugs, so I recommend reading the by hand portion solely to understand things-don't implement it in production code!

Assume you have the following HTML body:

<body>
    <div>
      <input type="button" onclick="getPeopleJsonp();"

             value="Get people" />  
    </div>
    <div id="people"></div>
    <script type="text/javascript"

      src="/wcfjsonp/Scripts/jquery-1.4.1.min.js"></script>
    <script type="text/javascript">
        function updatePeople(data) {
          var innerHtml = "";
          for (i = 0; i < data.length; ++i) {
            innerHtml += data[i].FirstName + ' ' +

                         data[i].LastName + '<br/>';
          }
          $("#people").html(innerHtml);
        }

        function getPeopleJsonp() {
          var innerHtml = "<script type='text/javascript' " +

                          "src='http://scottseely-xps/wcfjsonp/" +

                          "jsonp/names?callback=updatePeople'><\/script>";
          $("#inject").html(innerHtml);
        }
    </script>
    <div id="inject"></div>
</body>

What is happening here? When someone clicks on the button, the page calls getPeopleJsonp. That code updates the content of the div whose id is inject to contain a script tag. The script tag points to a JSONP endpoint and passes the callback parameter indicating to call the function updatePeople upon success. That script is then evaluated, executes a local JavaScript function, and returns. Every time that same script is reinjected, the same behavior occurs.

Now, jQuery provides a more succinct mechanism for doing the same thing. Instead of having the previous two functions and updating the DOM ourselves, we would write this:

function getPeopleJquery() {
  $.ajax({
    dataType: 'jsonp',
    url: "http://scottseely-xps/WcfJsonp/jsonp/names",
    success: function (data) {
      var innerHtml = "";
      for (i = 0; i < data.length; ++i) {
        innerHtml += data[i].FirstName + ' ' + data[i].LastName + '<br/>';
      }
      $("#people").html(innerHtml);
    }
  });
}

The code to inject information into the DOM still occurs, as does the creation of a callback function. What jQuery does is it adds script tag to the DOM only until the callback (success function) is done executing. The tag is added to the header. It also adds a function to the window object which is called on return. The URL jQuery constructs looks like http://localhost/WcfJsonp/jsonp/names?callback=jsonp1283609644773. What it actually does is add the following:

Within the window object, a new function is added:

jsonp1283609644773 is just an object living on the window object and is a dynamically added function. When the function is done executing, it will remove itself from the window object, leaving a slot by the same name with a value of undefined. What does the function look like when it is alive?

function(q){n=q;b();d();z[i]=v;try{delete z[i]}catch(p){}A&&A.removeChild(B)}

So, yeah, not too intelligible, but it does appear to handle things just fine. b(), d(), and the other functions are all part of the minified jQuery library, meaning that it all makes sense in the context of the containing object. The call to b() is contains code to call the success function. Everything else is cleanup code (at least from what it looked like to me.). To make this whole thing work in WCF, you need to do a couple simple things:

1. Only use WebGet to fetch resources.

2. Make sure the resource is hard-coded to respond in JSON. Otherwise, the response will appear as XML and the callback code won't execute.

3. Make sure your binding supports JSONP.

4. Make sure your service requires ASP.NET compatibility.

For example, to get the names, I have the following WCF code:

[ServiceContract]
[AspNetCompatibilityRequirements(
  RequirementsMode = AspNetCompatibilityRequirementsMode.Required)]
public class JsonpDemo
{
  [OperationContract]
  [WebGet(UriTemplate = "names", ResponseFormat = WebMessageFormat.Json)]
  public PersonName[] GetNames()
  {
    return new PersonName[]
              {
                new PersonName {FirstName = "Scott", LastName = "Seely"},
                new PersonName {FirstName = "Aaron", LastName = "Skonnard"},
                new PersonName {FirstName = "Matt", LastName = "Milner"}
              };
  }
}

Configuration has:

<system.serviceModel>
  <serviceHostingEnvironment aspNetCompatibilityEnabled="true"/>
  <standardEndpoints>
    <webHttpEndpoint>
      <standardEndpoint crossDomainScriptAccessEnabled="true" 
                        automaticFormatSelectionEnabled="true"/>
    </webHttpEndpoint>
  </standardEndpoints>
</system.serviceModel>

The crossDomainScriptAccessEnabled flag turns on the ability to correctly parse and respond to the presence of the callback parameter in the query string.

Finally, I added a route to handle the service within my Global.asax:

var factory = new WebServiceHostFactory();
routes.Add(new ServiceRoute("jsonp", factory, typeof(JsonpDemo)));

I was looking at the technology only to evaluate how to use it and to understand, a bit more deeply, how JSONP actually works. I found myself looking for a post that explains the magic, but most of the information I found just said "use jQuery." Handy-sure. But that didn't help me understand all the magic goodness that jQuery was doing for me.

Talking about REST

scott.seely@friseton.com (Scott Seely) — Thu, 02 Sep 2010 10:55:30 GMT

Mark and Clark over at developersmackdown.com just published 'my' show: http://developersmackdown.com/archives/SingleShow/30. We spent time talking about REST and SOAP as well as a number of other topics related to REST. One of the things that I don't think was made clear enough was that REST and SOAP are not competing service techniques. Each technology/interface type has an appropriate use case. When integrating applications within an enterprise, the development team needs to worry about:

- Security

- Transactions

- Reliable delivery of messages

- Integration with tooling for other developers

In the enterprise case, WCF + SOAP/WS-* can make integration between systems pretty simple. Yes, the teams may struggle with getting the security setup just right between domains, but overall, things will go well, especially if the setup requires communicating between different WS-* implementations. Finally, enterprise integrations typically happen for applications running on the same network/VPN. The infrastructure for an enterprise is different than that for the web. It's important to build your applications for their environment.

When integrating applications over the Internet, sometimes WS-* adds too much complexity. For extensive integration across partners who are connected via the Internet, there is some benefit to understanding REST. REST will allow your application to scale using the HTTP architecture. Features such as caching, proxy servers, and the general uniform interface exposed by HTTP helps make things work better on the global network.

Because of my point of view here, when asked "do you prefer SOAP or REST?", I am forced to answer "For what scenario?" I'm not popular in either circle, but understanding both helps me get stuff done.

Grand Rapids Day of .NET is Looking for You!

scott.seely@friseton.com (Scott Seely) — Sat, 28 Aug 2010 13:48:03 GMT

Planning is in full swing for the Fall 2010 Day of .NET (DODN) conference in Grand Rapids on Saturday October 23rd, 2010 at Calvin College.

The theme for this year is "Open to the Future". The theme combines two important trends in developing with .NET - "open" and the "future". On the "open" side there has been a lot of activity in opening up the platform, creating open source projects and libraries, enabling projects to work well in a mixed-IT environment, and opening up data to diverse applications. On the "future" side we see .NET 4.0 and Visual Studio 2010 which brings many new capabilities to the platform.

What this means for potential speakers is that there is a huge range of topics for you to consider. While this event is a "Day of .NET", speakers are encouraged to submit talks that span the spectrum of technologies being used in active development today.

This event is a great opportunity for new speakers and local speakers to get a chance to participate in the larger development community - come share what you have been learning and network with other speakers and participants.

In addition to having a set of planned ~1 hour talks, there is room available for open sessions. These can be from a 5-minute "lightening talk" to something longer that is of interest to an ad-hoc presenter and group. So if you have an idea for a session to be put on the schedule and promoted, please send it along ASAP. But if you also have something smaller, or that develops between now and then, please bring it along to the event and the organizers have a forum to share it.

Speaker submissions will be accepted between August 25 and September 18 and will have the sessions and schedule completed by the end of September for the event on October 23.

In a brief e-mail to grdodn10@live.com please provide your:

- Name

- Email

- Phone Number

- Twitter

- URL (Blog/Personal/Company)

- Brief Bio

- Session Abstract

- Session Level (e.g. 100,200,Advanced)

- Notes/Info (new presentation, done before?)

Project Phoenix

scott.seely@friseton.com (Scott Seely) — Thu, 19 Aug 2010 07:55:31 GMT

The current economic condition is hitting everyone pretty hard, even developers. For developers, part of the challenge in finding that next job is having the right, up to date skills. To help folks get those skills, Arnie Rowland and a number of other MVPs got together to pool MSDN subscriptions. This year, every MVP gets 3 MSDN Universal Subscriptions- 1 to use and 2 to give to worthy recipients. To pick a worthy recipient, an unemployed or underemployed developer needs to propose a software project for a non-profit agency, school, or church to be assisted by Project Phoenix. Arnie and his associates will then pick at least one project week to 'fund' with the MSDN Universal Subscription. A number of other companies joined in to offer more resources to help the selected developers make the most of this opportunity. Publishers have donated books and software companies have donated tools. I'm very proud that Pluralsight has donated a subscription to their .NET Training Library. I have created content for that library and am thrilled that an organization I am involved with is helping developers get back up to speed with current technology.

Project Phoenix is not a 'free lunch.' It supports the developers' efforts so that they can gain from the work they do. I do recommend that you visit Arnie's site to read all the details!

Here is the an example of one project that was funded:

Feed My Sheep: We are a community feeding program, that originally started as a 3 month summer project, one night a week we would provide a free meal for anyone who wanted to attend. We are in desperate need of a website in which we could post updates, have a calendar of volunteers and groups that will be serving each month and list special events.