Zeeshan Qadir

My Personal DNA

noreply@blogger.com (Zeeshan Qadir) — Sun, 27 Sep 2009 09:34:00 +0000

Last year, I took an online test designed by professional psychologists to assess one's personality using quite intuitive techniques.

The results were quite interesting and detailed. They were surprisingly quite close to my personality as well. It categorized me as a Benevolent Architect and different aspects of my personality depicted by the below coloured boxes.

Today I happened to see the detailed report of it again and I was once again amazed by the accuracy of the report. The report not only covered who am I, but also provides information regarding what to change if I want to be different. I really wonder how come they can provide such a detailed yet an accurate analysis of one's personality based on the answers to a few dozen of questions. I thought it's worth sharing the summary of the report represented in the form of these coloured boxes.

Take your mouse on the different coloured boxes above to see the different aspects represented by my personal DNA.

One must try this test at www.personaldna.com, however sharing the results with other's is a matter of personal choice.

Long Time!!!

noreply@blogger.com (Zeeshan Qadir) — Sun, 12 Jul 2009 09:31:00 +0000

It has been quite some time that I have not been that active on my blog, as I used to be a year back. Now, I am getting back to the routine and have been eagerly waiting to get back to my blog. However, before I get back, I thought it’s a good idea to share what has been going on at my end in the last few months.

It was back in October 2008 that my company’s vice president asked me to be one of the authors of the official blog of the company. The aim was to present the technical leadership and technical diversity of the resources we had at the company. So, I decided to start blogging for the company’s blog. The first thing I did was revamping the complete blog so as to have a consistent look and feel of the blog with the company’s website. Then, I wrote a few articles on HTTP Compression, Engineering Enterprise Level Applications using Microsoft .NET Framework and User Experience Design Patterns. The experience was great and the recognition was worth the effort.

In January 2009, I decided to relocate to London, UK for work. I got Tier 1 in February, left my existing job at TRG TECH; The Resource Group in March, moved to UK in April, started working for a multi national MVNO in the name of Lebara in May 2009.

So over the past few months there have been quite some transitions going on and I was unable to keep up with my blog. However now I am getting back to it.

One of the many good things about all these transitions is that my technology spectrum and technical horizon is increasing. Previously I have been working purely on the call centre centric software product development with all the energies channelized in re-engineering a high availability, fault tolerant, scalable, secure and rich interactive solution, but now at my new job at Lebara, I am working more on integration and B2B projects, along with extending and customizing Microsoft’s business management software product range.

Now you can expect a bit more technical diversity on my blog with some technical articles on Microsoft Dynamics as well, in addition to the .NET and Java Script stuff. Hope you would like it.

Google Analytics reveal the 'Top 7 - Last One Year'

noreply@blogger.com (Zeeshan Qadir) — Wed, 06 May 2009 09:01:00 +0000

I have been using Google Analytics for quite some time now to find out some of the hidden facts and a few of the interesting user trends on this blog.

Today I generated a report of the most visited blog entries for the last one year and found that people love to read about ExtJS and other web 2.0 stuff; my blog is getting the attraction of a lot of such readers.

Here are the rankings - you might be interested in reading a few of them as well!

Now blogging at the official trg tech blog

noreply@blogger.com (Zeeshan Qadir) — Tue, 18 Nov 2008 17:08:00 +0000

I have recently started blogging on the official blog of my company; trg tech.

We plan to share the experiences of trg techies at trg tech on the official trg tech blog. Other than the technical stuff, you will also find words from the recruiters and others at trg tech in order to get to know about the lifestyle of trg techies at their very own company i.e. trg tech.

Hope you would like the posts over there too. Its http://trgtech.blogspot.com.

Google Chrome – Web Browser for the Next Generation of Web Apps

noreply@blogger.com (Zeeshan Qadir) — Wed, 03 Sep 2008 12:19:00 +0000

Google Chrome is available for download from today!

It’s a brand new web browser by Google for those who love GMail, Google Docs and other JavaScript centric web applications; applications which have truly proved the very essence of Web as a Platform.

Google Chrome is yet another examplification of the simplicity and elegancy of Google’s User Interfaces. It’s fast, it’s speedy and it’s yet another innovation on part of Google in terms of its memory management and JavaScript execution. It considers every tab and every website as a separate process. Google has definitely created a benchmark in Web Browsers.

It has got features that are very useful for Web2.0 Engineers. It has got built in DOM Inspector, JavaScript Debugger, Network Traffic Analyzer, Memory / CPU / Network Profiler so that you can precisely know which web app or web page is taking more memory, CPU or bandwidth.

Google has not just engineered this whole thing but have presented the whole concept behind it in an equally superb way. Read the full story of Google Chrome at http://www.google.com/googlebooks/chrome/# to explore what it actually is.

How To: Setup JavaScript IntelliSense for ExtJS in Visual Studio 2008 (SP1)

noreply@blogger.com (Zeeshan Qadir) — Sun, 17 Aug 2008 07:46:00 +0000

One of the much awaited features incorporated in Visual Studio 2008 Service Pack 1 is the JavaScript IntelliSense support for 3rd Party JavaScript Frameworks like ExtJS, jQuery, Prototype etc.

Now you can add references to your 3rd party libraries in you JavaScript files and JavaScript blocks, and Visual Studio 2008 (on installation of Service Pack 1) will start recognizing the classes and functions defined in those libraries.

In order to setup ExtJS JavaScript IntelliSense you just need to add the following lines (/// reference tags) in your JavaScript files or script blocks to make it work. (Adjust the relative paths to the two JavaScript files as per your website hierarchy)

And here is the outcome; ExtJS based classes are now available in IntelliSense

Moreover a variable that’s initialized as with ExtJS based Store is now showing the respective methods of Ext.data.Store class in IntelliSense

I have updated the ASP.NET AJAX with ExtJS sample to incorporate this JavaScript IntelliSense feature. You can download the updated code sample from here.

What I can say about this feature is; it is simply a superb addition in Visual Studio feature set and will definitely increase the popularity and penetration of JavaScript based frameworks and libraries.

TRG Tech Talk Series: “AJAX – Inside Out”

noreply@blogger.com (Zeeshan Qadir) — Wed, 02 Jul 2008 18:04:00 +0000

I gave a presentation at my company in connection to the new Tech Talk series initiated by TRG TECH. I was honored to be the very first one to have a Tech Talk in this connection. The topic I chose for this first Tech Talk was “AJAX – Inside Out”. The reason for choosing this topic was to build the foundation for our upcoming Tech Talks on engineering rich, interactive user experiences over the web which me and my team will be conducting in a month or so.

My presentation covered everything related with AJAX including

Web 2.0
XMLHTTPRequest
Hidden Frames
ASP.NET AJAX
JSON
Programming Model of ASP.NET AJAX
Server Centric Programming Model
Client Centric Programming Model
Trade Offs of the two Programming Models
Supporting tools for Web 2.0 developers for analyzing the network traffic created by your web app, manipulating DOM, styles and other aspects of your web app and browser.

The supporting tools for the debugging and analysis included the following

Internet Explorer Developer Toolbar
Nikhil Kothari's Web Development Helper for Internet Explorer
Firebug for Firefox
YSlow for Firebug

I also gave three demos/code walkthroughs during the course of this presentation one on each of the XMLHttpRequest, UpdatePanel and PageMethods.

The feedback and response was overwhelming and the hall remained jam packed till the end :)

You can download my presentation from here so as to have a deeper look at it and get better insight of AJAX really from inside out.

Emprise JavaScript Charts with ASP.NET AJAX

noreply@blogger.com (Zeeshan Qadir) — Sun, 29 Jun 2008 18:24:00 +0000

I am a big fan of ExtJS for engineering rich interactive user interfaces for all the data centric web2.0 based applications, but one of the components that’s missing in ExtJS is the charting component. I consider ExtJS as a comprehensive java script based UI Framework but still they haven’t focused on providing Java Script based charting controls so far.

Most of the charting controls I came across are server centric and require the chart image to be transmitted to the web browser; others require some plug-in (Flash Player etc) to be installed on every client machine or some other limitation.

I came across EJS Charts (Emprise Java Script Charts) some time back and found it really useful in fulfilling the gap in the graphical data presentation needs over the web by presenting these charts in an equally responsive fashion like the data.

The good things about them are

They are purely Java Script based charting controls, doesn’t require any plug-in to be installed on client machines
They are pretty much interactive; provide features like zooming, mouse hints etc.
Just provide them with the data in java script (arrays, xml, csv) and they will render the specified chart at the client end.
Series can be added to / removed from an already rendered chart so as to get the affect of a continually updating chart.
Minimizes the overall network traffic generated by the web app, they require transfer of just the data between the server and web browser and not the complete chart in image format.
Programming model is fairly simple.
Works with all the modern browsers i.e. Internet Explorer 6 and above, FireFox 1.5 and above etc.

The bad things about them are

They don’t provide extensive range of chart types as provided by other server side charting controls, but I hope that they will mature over the period of time.
They are not widely spread so far; people are really un-aware that this thing can happen at the client end too.

Here is the simple sequence of steps you need to follow in order to utilize these web2.0 Java Script based charts in ASP.NET AJAX.

Call the server method to get the data (e.g. List<keyvaluepair<string,int>>) from the ASP.NET PageMethod (if required, otherwise use the data got from the last call to the server method) and hook the callback for it.
In the callback function, check if the EJS based 'Chart' object is already defined, if not then define one. The constructor of that EJS Chart takes a div id where it needs to render the generated chart. You can optionally specify other properties in the constructor for the chart in order to customize title, captions, hints, legend, gridlines and other visual and behaviour related properties of the chart. If a series is already added in the previosuly generated chart, remove it so that the new series as per the user selection can be added to the same chart instance.
Transform the data returned from the Server (e.g. List<keyvaluepair<string,int>>) to an ordinary 'Java Script Array'
Define the EJS based 'Chart Series' (LineSeries, BarSeries or AreaSeries etc) as per the user selection and supply the array you have just created as the datasource for the chart.
Add this 'Chart Series' instance to the 'Chart' instance

Here are the images of the charts generated from the sample code I have uploaded for you to have a look at and experiment.

You can download the sample code that uses EJS with ASP.NET AJAX (that present different graphical representations of data based on user selected chart type) from here. Please note that the sample code uses ASP.NET 3.5 (December Extensions Preview) and EJS Personal Edition (EJS personal edition has got a few limitations too, read more about those from here).

FxCop – Automated Code Review for .NET Assemblies

noreply@blogger.com (Zeeshan Qadir) — Tue, 22 Apr 2008 05:06:00 +0000

I have been using FxCop on and off, for quite some time now, for the automated static code review of .NET Assemblies for possible design, security and performance issues (inefficient string manipulation / comparisons, unused utility functions, unnecessary casting, security vulnerabilities etc).

I would recommend it to all those, who want to cross check their .NET Assemblies conformance, with the Microsoft’s Best Practices and Design Guidelines. What it actually does is that, it has a rule base of more than 200 rules organized in different categories, against which it inspects your .NET Assembly. You can selectively check your assembly for performance and security issues or you can specify whether you want to skip the Naming Rules conformance for a particular code analysis run or not.

Once installed and opened, you only need to do is ‘Add Target’ to your new project; target is the .NET Assembly (dll / exe) you want to inspect. Once you have added the Target(s), press ‘Analyze’ button in FxCop toolbar. Once the analysis is done, it will provide you with a granular report, drilled down to function level for the possible issues in your code. The good thing is that, it won’t only report the issue but will also report the reason and possibly the recommended fix for it!

Once you will start using it, you will eventually learn from it and will definitely avoid making those mistakes in future development. You can download latest release of FxCop from here.

How To: “Getting Started with C# 3.0”

noreply@blogger.com (Zeeshan Qadir) — Sat, 09 Feb 2008 14:41:00 +0000

Here is my suggested approach on how to get started with C#3.0. This strategy is advised to be followed by those who are seasoned programmers in .NET 1.1 / 2.0, and now they want to get their hands on C#3.0. It’s quite an easy migration as far as the core language enhancements in C#3.0 are concerned. One can get a good know how as well hands on experimentation of the new features in a matter of hours.

So here go the steps on how to get started with C#3.0.

C#3.0 Language Specifications
Go through the C# 3.0 Language Specifications. It’s just a 26 page document, containing each of the new feature definition as well as the code samples. If you have been working in C# 2.0, you can go through it in a matter of 3 hours.

I don’t want to reproduce what ever is in the above document, but just to give you an idea that there are only a few additions in C# 3.0 and those are the implicitly typed local variables, extension methods, lambda expressions, object initializes, anonymous types, implicitly typed arrays, query expressions and the expression trees. These additions serve as the foundation for LINQ (Language Integrated Query) and make the code concise.

You can download the C# 3.0 Language Specifications document from here.

C#3.0 Language Enhancements Hands On Lab
There is a comprehensive hands on lab exercise outlined by Microsoft, and that’s too isn’t that long, and would only take a few hours to go through and experiment, for a seasoned programmer.

You can grab the complete script of the Hands on Lab from here.

“Best Developer” Award by TRG; The Resource Group

noreply@blogger.com (Zeeshan Qadir) — Fri, 08 Feb 2008 18:21:00 +0000

I have been recently awarded the “Best Developer” accolade by my company, TRG; The Resource Group at the Annual Employee Appreciation Day 2007 on 3rd Feburary 2008.

It was a total surprise for me and unfortunately I missed the ceremony (was out of town) :( but still it’s always a good feeling, to be the one amongst the hundreds :)

The much awaited .NET Framework source code is finally available

noreply@blogger.com (Zeeshan Qadir) — Thu, 17 Jan 2008 08:43:00 +0000

The source code of .NET Framework is finally available under a read only reference license, enabling programmers to browse the source code and debug their programs more deeply and effectively.

It seems that now the code of .NET Framework is so mature that they are releasing it for public. Let’s see how the proponents of open source perceive it.

Currently the following libraries have their source code available for browsing and debugging.

NET Base Class Libraries (including System, System.CodeDom, System.Collections, System.ComponentModel, System.Diagnostics, System.Drawing, System.Globalization, System.IO, System.Net, System.Reflection, System.Runtime, System.Security, System.Text, System.Threading, etc).
ASP.NET (System.Web, System.Web.Extensions)
Windows Forms (System.Windows.Forms)
Windows Presentation Foundation (System.Windows)
ADO.NET and XML (System.Data and System.Xml)

More and more libraries are said to be included in the above list.

You can refer to the the post by Shawn Burke on how to configure your Visual Studio 2008 to debug the .NET Framework Source Code.

FireBug + YSlow for Mozilla Firefox: A must use tool for all Web2.0 developers

noreply@blogger.com (Zeeshan Qadir) — Wed, 09 Jan 2008 11:46:00 +0000

I have been very keen in improving the response time of web applications and used to postmortem the web applications from the perspective of their initial load time, overall network traffic created, number of requests sent and the overall network traffic created to perform an action and a number of other parameters.

In order to perform this postmortem, the Mozilla add on in the name of Firebug comes in picture and really provide very useful and good enough information on the overall network traffic created, contents of each of the user request / server response, runtime inspection and modification in the CSS, HTML and Javascript of the currently viewed web page, JavaScript Debugger support for the java script statement “debugger;”, DOM Inspector and much more.

Thus, using this tool (Firebug; Mozilla Firefox Add-on), a Web 2.0 developer can very easily analyze which user action creates how much traffic behind the scenes using AJAX, which user action is performed at the client side, how much requests are generated for each user action, what’s the size of request / response for a user action and other such stuff related with the debugging of Java Script, modification in CSS and DOM Inspection. So, I would recommend every web developer who is involved in evaluating the different UI controls to be used in web applications or other such tasks related to improving the overall user experience of a web application to try this add-on; FireBug on FireFox. A snapshot of this tool, is shown below.

There is in add-on in FireBug in the name of YSlow. That provides information on how to improve the performance of your website. This add-on is by Yahoo Developer Network and automates the verification of all the Consideration for High Performance Websites in this single tool. This not only verifies and ranks the website against the said Best Practices for High Performance websites, but also provides information on what’s wrong and what you can do to improve the performance. A snap shot of the YSlow Addon of Firebug is shown below.

Something similar but with relatively lesser features is the IE Developer Toolbar, which Internet Explorer centric Web 2.0 developers, should definitely have a look at and experiment with. [Added: 22nd April 2008]

Another easy to use tool out there for Internet Explorer to perform a similar analysis of web applications (a bit buggy on I.E 6 at least on my machine) is the Web Development Helper by Nikhil Khotari. Below is the snapshot of that.

ASP.NET 3.5 Extensions Preview: Dynamic Data Websites Part 1, Engineering Data Centric Web Application from End-to-End

noreply@blogger.com (Zeeshan Qadir) — Tue, 08 Jan 2008 18:25:00 +0000

I hope you have gone through my last post that lists all pre-requisites for this tutorial and have prepared the development environment, on how to get hands on with these tutorials and walkthroughs on the newly added features in ASP.NET 3.5 Extensions Preview.

Here comes the very first tutorial in the series that’s on the Dynamic Data Websites. The reason for starting the ASP.NET 3.5 Extensions Preview tutorial series with this Dynamic Data Websites feature is to demonstrate how quickly you can engineer a data centric web application with the newly added features of ASP.NET 3.5 Extensions Preview. You will learn that the overall code required to be written by the end developer is reduced to the extent that one merely needs to write a few lines for any custom business rules or any customized view of the data which one may require as per the custom needs.

The pre-requisite, the portion I will not be covering in this tutorial for engineering a data centric web application from end-to-end is the designing of the database. I will assume that you have your database designed, tables and relationships with Primary and Foreign Keys created. The database I will be using for my tutorials as stated in the last post is the well known, Microsoft provided “Northwind” database.

So let’s start with the step by step walkthrough, in this part of Dynamic Data Website walkthrough I will be covering on how to engineer a web application with the built-in templates and features as provided by Microsoft in the ASP.NET 3.5 Extensions Preview. In the next post I will demonstrate on how to customize the generated web application by incorporating custom business rules and designing custom views as per the custom needs of your business. So, let’s get started with the step by step procedure.

Create a new website, by clicking the “New Web Site” item in the “File” Menu. A dialog box titled “New Web Site” appears. Select the “Dynamic Data Website” from that “New Web Site” dialog box and set the location for that new Dynamic Data Website. Here I name the website “DDWDemo” i.e. Dynamic Data Website Demo.

A new website containing the files/structure as shown below is created.

Now we need to add database to our web application, for that I create the App_Data folder in my web application and drag n drop the mdf file of the “Northwind” database to it.

Now we have our database added to our web application. I will start with generating the Business Entities for my Northwind database, so that I map my data in the Relational World to my Object Oriented World, and doing so is facilitated by the “LINQ to SQL Classes” feature of the ASP.NET 3.5 Extensions Preview. I will create a new LINQ to SQL Classes instance, which are internally mapped to relational objects, by right clicking on my website and selecting Add New Item. I select the LINQ to SQL Classes template and name it SCM.dbml (here SCM stands for Supply Chain Management and not the Software Configuration Management) and click Add. A prompt appears asking me to automatically put the files in the App_Code folder; I click on ‘Yes’ for it, and my LINQ to SQL Classes files is added in my project. This file provides me an Object Relational Designer through which I can easily generate my DataContext Class as well as the ADO.NET Entity Classes.

Now what we do is that I double click on my Northwind database in the App_Data folder, it will open the database in the Database Explorer. I expand all the tables under it, select all the tables and drag and drop them on the left pane of the SCM.dbml file, that’s the object relational designer surface to auto generate my Data Classes for all the tables I have dropped on it. It will also automatically create the relationships among the generated classes by improvising them form Primary / Foreign Key Relationships in the Database. You can view the code generated by this action by expanding the SCM.dbml file and browsing the SCM.designer.cs file. The SCM.designer.cs file will contain the definition of SCMDataContext that allows access to all tables and handles the CRUD operations on the Business Entities through LINQ queries, moreover the SCM.designer.cs file contains definition of all the business entities, which are actually the ADO.NET Entities. One thing to note about them is that these generated business entities are defined as partial classes and also provides some extensibility methods (we will learn using them in part 2 of this tutorial).
So, by now we have our Business Entities defined which are directly mapped to the Tables. Now we need to present them in a good way to the user so that User can perform the CRUD (Create, Read, Update and Delete) operations on these. This is facilitated by the use of templates defined in the Dynamic Data Website template. What we need to do is to set the enableTemplates attribute of the dynamicData section in web.config file to true. I can also optionally set the dataContextType attribute of dynamicData to SCMDataContext. So here, what I have done is that I have enabled the templates for the List and Details view of all the Business Entities defined in the SCMDataContext. By default it will use the ListDetailsTemplate.aspx for all the business entities. The ListDetailsTemplates.aspx is defined in the subfolder App_Shared/DynamicDataPages so that I can customize it to give a personalized look and feel. This template uses the master page defined in the website as MasterPage.master which I can customize too for the personalized look and feel; here I customize the main heading of the website to be ‘Supply Chain Management’ instead of dynamic data controls site. Just a food for thought that the ListDetailsTemplates.aspx uses the newly introduced Dynamic Data Controls and I would recommend having a look at these templates to get some idea on how it’s utilizing the features of ASP.NET 3.5 Dynamic Data Controls behind the scenes.

Now, start the web application by clicking on the Start Debugging button in the toolbar of Visual Web Developer 2008. A prompt stating the Debugging isn’t enabled, simply click OK button on it to enable debugging and a web application with the default templates appears in front of you.

So, here in this tutorial, we have learnt on how to generate a Data Centric Web Application using ASP.NET 3.5 Extensions Preview, in a few clicks. In the second part of this tutorial which I will be posting in a day or two, I will demonstrate on how you can customize the Views for some of the entities, use some other template for some other entities as well as enforcing you custom business rules in the Business Entities.

You can download the complete source code of this walkthrough as a single package from here.

ASP.NET 3.5 Extensions Preview: Walkthroughs, Tutorials and Code Samples

noreply@blogger.com (Zeeshan Qadir) — Wed, 02 Jan 2008 19:26:00 +0000

Long time, no posts!!!

With the release of ASP.NET 3.5 Extensions Preview a couple of weeks back, I have been busy in experimenting with the new features and controls added in this very first preview of ASP.NET 3.5 Extensions.

The new additions like Dynamic Data Websites, Dynamic Data Controls, LINQ to SQL, ADO.NET Data Services and their invocation using AJAX, LINQ enhancements, ASP.NET AJAX enhancements definitely added sufficient enough data points to the proponents of ‘Using ASP.NET for RAD’.

Having said all that, the ASP.NET 3.5 Extensions Preview also includes the first public preview
of the much awaited built-in ASP.NET MVC Framework as well, the final release of which is expected in first half of this year. The addition of this built-in ASP.NET MVC Framework added a sound Architectural Pattern to the ASP.NET Web Development portfolio and it not only enforces the separation of concerns but also facilitates TDD that’s the need of the hour.

Earlier this week I have been presenting the said new additions in ASP.NET 3.5 Extensions to my office colleagues in successive training / tutorial sessions titled “What’s new in ASP.NET 3.5” on each of the newly added features and they went great and, from now I will be posting the scripts / walkthroughs with code samples of all those sessions over here by this weekend, for my office colleagues in particular and rest of you in general.

I used the well know “Northwind” database in all the tutorials so that I every one has the general idea of the DB Schema. For your convenience I will be including the Database files in the sample codes of each of the tutorial as well, in order to provide you a single code sample package for each of the tutorial.

In the mean time I would recommend all of you to prepare the Development Environment for those tutorials and walkthroughs accompanying the code samples which I will be posting by this weekend. All you need to have on your system is the Visual Studio 2008 and the newly released ASP.NET 3.5 Extensions Preview. If you don’t have Visual Studio 2008 then for the time being you can go with the free Visual Web Developer 2008 Express Edition as well instead of Visual Studio 2008. You can download Visual Web Developer from here and the ASP.NET 3.5 Extensions Preview from here.

Keep your fingers crossed for Walkthroughs + Code Samples on Dynamic Data Websites, ADO.NET Data Services, LINQ and last but not the least the ASP.NET MVC Framework.

The Technology Bubble

noreply@blogger.com (Zeeshan Qadir) — Tue, 11 Dec 2007 08:41:00 +0000

Here is a Silicon Valley music video by the Richter Scales, a must watch for all those web geeks out there, who are inspired by the success of MySpace, Orkut, Facebook, Digg, Flickr, Del.icio.us ..... blah blah. Hope you will enjoy it

http://www.youtube.com/watch?v=I6IQ_FOCE6I
(Links Updated On 29th December 2007)

Engineering Secure Web Apps in ASP.NET 2.0

noreply@blogger.com (Zeeshan Qadir) — Mon, 10 Dec 2007 07:43:00 +0000

Security is one of the critical components in the engineering of any web application but unfortunately it isn’t handled in an equally critical way. With an ever increasing popularity of providing access to information over the web at a mouse-click, security concerns are increasing with a similar pace.

Below I have jolted down the list of some of the major security related items (you can call them ASP.NET security best practices, security checklist or the tips and tricks for engineering secure web applications in ASP.NET) which one must keep in mind, while engineering an ASP.NET Web application in which “SECURITY IS A CONCERN”.

My approach is not to provide you the complete end to end solution to each of the concern, but to highlight and provide pointers to the different approaches to cater each of these security items in the check list.

User Authentication

You can use the built-in authentication mechanisms (Forms, Windows and Passport) or Custom Authentication (Session Based; storing some user specific value in user’s session at the time of authentication so as to validate the user for subsequent requests by the same user, Using Hidden Fields; the traditional way but un secure way of maintaining authenticated user information etc).
You can use the built-in login controls provided in ASP.NET 2.0. Additionally in order to have a granular control over the User Authentication process refer to the Membership and Role Management API. In case you want the Login Controls / Management API to work with your custom database, you can write your own Membership and Role Provider.
In case you need to implement the “remember me on this computer” feature, use cookies with “One Time Password” design pattern.

Encrypt sections of the configuration file having confidential information

Whenever you need to put any confidential information in the configuration file like the database user name / password, don’t leave that information in plain text in the configuration file, rather encrypt it using the built-in “aspnet_regiis” utility with the command line option “-pe”. The aspnet_regiis.exe is located at :\WINDOWS\Microsoft.NET\Framework\v2.0.50727.
Once a section of the web.config file is encrypted then contents of that section aren’t human readable whenever that file is opened in some text editor, however when you access the configuration information through ASP.NET (the .NET 2.0 framework) it knows how to decrypt the contents and provide actual contents to the application.
You can use the Management API in order to programmatically encrypt the sections of your Web.Config file. The Management API added in ASP.NET 2.0 is very rich and provides you access to the complete configuration of the application and ability to modify the configuration file on the fly.

One-way encrypt the user passwords before storing in database

Never store user passwords in the database, in plain text. Store them in Encrypted format using any one way encryption algorithm like MD5, best is to encrypt (MD5) the user passwords at the client side using JavaScript and then at the server store it in the database.
Later on when the user wants to log in, encrypt the user entered password using the same encryption algorithm and then match it with the password in the database.
In case the user has forgotten his password, provide user an interface to set a new password after performing necessary validations. You can send a link to set new password for that user at his email address.

Use database user having limited rights

Create a user in the database that has limited rights (INSERT, UPDATE, SELECT and may be DELETE from specific tables) only those tables of the database that needs to be accessed by your web application, and use that user to access the database from within your application.

Show custom error pages with user friendly error messages

Never show the built in error page, telling the complete error detail for debugging the error to your end user. That discloses a lot of information that’s not intended for an end user.
You should better show custom error pages to the user with user friendly error messages while Logging the actual error occurred for the application developers to re-produce / debug and eventually resolve that error.
Always handle any of the unhandled exception in the Application_OnError event, use the Server.GetLastError() to get the detailed information about the error that occurred, while showing the user a custom error page and logging the actual error.

Check the Request’s Referrer Property

Check that the request has actually originated from your own website (from an intended page). Not checking so can lead to un precedent attacks

Handle SQL Injection Attacks

If you are using stored procedures, then you will be using SQL Parameters to send the user input to it and get the results. In that case your application isn’t prone to SQL Injections. However using the Stored Procudures or not in your web application is another debate, lets not get into that and focus on handling SQL Injections.
The problem comes when you are using inline queries and concatenates the user input with in the SQL Query. A well tailored user input by a hacker can break your security checks as well as can possibly drop the tables in your database etc. by using the single quotes and comment signs with in the user input. So concatenating the user input’s as is in inline SQL Queries can be fatal for your web application.
Use SQL Parameters even with “inline queries”, they automatically cater for the SQL Injection attacks.

Handle Cross Site Scripting Attacks

ASP.NET default behavior doesn’t allow the user to enter tags “” and shows an error page if such input is entered in a form field.
Some application may need to allow the user to enter information in tags, but this will result in potential security leaks, that’ named Cross Site Scripting. A user can write the <script&rt; tag, which can be possibly rendered to another user browsing the site. That script tag will be executed in the context of that second user, and that intelligently tailored script tag can possibly access the second user cookies etc and moreover can possibly submit a malicious request with the second user credentials using XML Http Request / AJAX etc.
Use the Microsoft’s AntiXSS Library to handle cross site scripting attacks.

Handle Dictionary Attacks – Captcha

Hackers can attack your website authentication system and submit automated login requests to crack the passwords of authenticated users of your protected website. You should check that your Login form / Authentication system isn’t attacked by this, by ensuring that it’s accessed by humans (asking the user to enter the characters shown on a bit distorted but human readable image). For more information on Dictionary Attacks point to Wikipedia

Denial of Service Attacks

The last resort for any hacker of your website is the denial of service attacks. You should track the activity for each of the user and should limit the repeated requests sent by the same IP to a decent number.
You can use the ASP.NET AJAX Control Toolkit – No Robot Control to help you out in this, but it should be used with caution as stated on the above website.

Log user activity

This way you don’t only capture some very useful data about the user trends but this data can also help you detect any un-desired activity made by the user.
You can use the Enterprise Library Logging Application Block log the user activity. Microsoft Enterprise Library’s Logging Application Block has the feature to log in the database, so that you can later on query it and create reports on it to find not only any interesting patterns based on “User Pathology” but can also point out any un-desired user activity.

I hope this pretty much covers most of the security check list items. However, I will be adding more and more to it, to provide a to-date comprehensive guide for engineering secure web apps in ASP.NET 2.0

How To: “Getting Started with ASP.NET 2.0”

noreply@blogger.com (Zeeshan Qadir) — Mon, 10 Dec 2007 07:10:00 +0000

I have been asked a number of times, by students, fresh graduates and my office colleagues, on how to get started with ASP.NET 2.0? The people asking me this question have different exposures (some haven’t worked in the web domain at all, some have worked on static web pages, some have worked in classical ASP 3.0, some have worked in other server side scripting languages like JSP/PHP etc and some have worked in ASP.NET 1.1) but all of them have a Computer Science background, and now they are looking for the tips & trick and resources to get their hands on ASP.NET 2.0.

So, I decided to share “My Proposed Strategy of Learning ASP.NET 2.0” over here for people to look at and get started. Although the points listed below don’t apply to every one, and that varies, depending on a person’s level of exposure in engineering web applications.

My strategy is to start from the basics and finally conclude by providing pointers to resources for engineering more sophisticated applications in ASP.NET 2.0.

Know how of basics i.e. HTML, JavaScript and CSS
One thing a person must have an idea of, before directly starting to work on ASP.NET 2.0 is the basics and the fundamentals of developing any web page i.e. the person should have the idea of HTML, JavaScript as well as CSS. Without the basic knowledge of these three, it’s really not going to end up too far in engineering sophisticated web applications. One quick reference to get started on all these is http://www.w3schools.com/. Navigate to the relevant tutorials on the left panel to get a quick review of HTML, JavaScript and CSS.

Know how of Client-Server Interaction in Web Apps
Once you are done with the basics, you should have an idea of the interaction of the Client (web browser) and the web server (IIS etc) in any web based application.

The client sends a request to the server, server processes that request and finally sends the response back to the client. So, it’s a “request/response” based interaction between the web client and the web server.

Moreover this interaction between the client and the server is stateless. Cookies are used to maintain state at the client as well as the server between the successive requests made by a single client (wherever management of user state, between successive requests is required).

Know how of Implicit Objects in any Server Side Scripting Language
After that, a person should have an idea of what a server side scripting language is and the implicit objects available in that as well as the capability / role of each of those implicit objects. Those implicit objects include Request, Response, Server, Application and Session.

Development Environment
Once you are done with this much background knowledge, you should have the right development tools / IDE as well as the .NET 2.0 Framework (also comes packaged with IDE) installed on your machine. If you have Visual Studio 2005 available with you, that’s well and good as it will install the Framework, the IDE as well as the SQL Server 2005 Express through a single install package. Otherwise you can download and install the “Free Version” in the name of Visual Web Developer 2005 Express Edition (IDE for ASP.NET 2.0, contains the.NET Framework 2.0) and the SQL Server 2005 Express Edition (Backend Database Server). You can download them from for free from the Microsoft Website i.e. http://www.microsoft.com/express/2005/download/default.aspx

ASP.NET 2.0 Beginners / How Do I Video Tutorials
A picture is worth a thousand words and a guided video have a much more impact. So I recommend people to view web casts on ASP.NET 2.0 and related topics to have a better and quicker insight of it. The official ASP.NET website provides a very good pool of video tutorials on ASP.NET 2.0 which I strongly recommend people to download, watch and eventually apply. You can point to http://www.asp.net/learn/videos/#beginners for those video tutorials.

ASP.NET 2.0 Quickstart Samples
By now you must have been able to develop a good enough small sized web application in ASP.NET 2.0. However you still are in need to some samples / code examples and a quick description of each of the feature of ASP.NET 2.0. Here, the excellently tailored ASP.NET 2.0 Quickstarts serves the purpose. You can point to the official ASP.NET website http://quickstarts.asp.net/ for an online version of these code examples and related descriptions of each of the features of ASP.NET 2.0. The code samples in these Quickstarts are available both in C# and VB.NET depending on user preference.

Microsoft Patterns & Practices: Enterprise Library
People at Microsoft Patterns & Practices are working quite devotedly to provide you with Libraries and APIs needed for the development of your applications in .NET Framework. You can leverage from their very first initiative the Enterprise Library, which has evolved over the period of time and is much mature now. You can get the latest version 3.1 of it, which works with the .NET Framework 2.0 / 3.0 / 3.5 from http://www.codeplex.com/entlib

Microsoft Patterns & Practices: Software Factories
Still need some more pointers to engineer a more sophisticated web applications? Look for the Software Factories; another great initiative of Microsoft Patterns and Practices Team. Refer to the Web Client Software Factory on CodePlex for more details.

Strongly Recommended
The Data Access Application Block, Logging Application and Caching Application Block of the Enterprise Library are the ones which one must try. I can guarantee that you will find them really helpful in engineering your applications without bothering much about these common functionalities.

I also strongly recommend all those who want to have quick hands on, on ASP.NET 2.0 to locally install quick-starts on their own development machines (available under the Microsoft .NET Framework 2.0 SDK in Visual Studio 2005 installer), and go through the topics and code samples whenever you are free. This will really help you in getting a broader idea of the capabilities of ASP.NET 2.0.

Comet: The futuristic view of web applications – A food for thought!

noreply@blogger.com (Zeeshan Qadir) — Wed, 28 Nov 2007 08:27:00 +0000

I hope that this word “Comet” must be a new one for most of you. Might be some of you have heard about it in the name of Reverse AJAX or Server Push or HTTP Streaming or LazyHTTP or Long-Lived-Http-Requests or what not. These all are different names given to variations of the same idea, trying to achieve the same goal one way or other.

Here I will try to explain “What Comet actually Is?” So, let’s start with the basics. HTTP protocol is based on the pull model i.e. the client sends a request to the server, the server processes that request and sends the response back to the client. This conventional way leads to serious bandwidth + network traffic + scalability issues for web applications that need to provide some real time information i.e. news ticker or stock quotes or a web based chat client kind of things over the web. Considering this pull model of HTTP, the web application simulates the real time updates of the news / stock quotes ticker by periodically sending AJAX requests using some Java Script timers or a similar approach. So in that case my application is generating periodic XMLHttp Requests irrespective of the fact whether there are any updates on the server or not, this leads to a substantial over head in terms of the network bandwidth, web server’s scalability and performance. This way of simulating the real time updates is call the Ping Model, in which you are continuously ping-ing the server to get any of the updated contents available on the server.

What if I don’t want to Ping the server for updates? What if I want the web server itself to notify the client whenever there is an update? Can we really do that? Is it possible over HTTP? Is it possible in ASP.NET + IIS? These are the questions which must be storming your mind by now.

What I can say about all this is that, there are several giants who are into it, like Google is achieving this task some how on it’s Google Talk web chat panel inside GMail web based interface. Meebo is also providing that server push kind of thing for its web chat platform. There are also several (experimental + commercial) implementations of Comet which are available out there.

Still I have serious doubts about the scalability any such solution. What we know is that HTTP is based on the pull model, then how can these implementations achieve a real server push over HTTP? What as per my feeling, they are doing is simulating the server push using Long-Lived-Http-Requests or the other option to achieve Server Push is to bypass HTTP and use the Raw TCP sockets, but that would lead many other concerns related with security, scalability etc.

Another way to achieve this server push on Web is using Sockets in Flash movies, these flash movies can be easily embedded in web pages that can be shown over HTTP, but in that case we need a Flash Communication Server. Thus even for that, there is some thing that’s required from the server to achieve this push kind of behavior in web applications to provide real time information on web pages.

So far, Microsoft is quite on this. Let’s see how things turn out from there end.

Below are a few links to the related articles and working samples to increase your urge to learn more and more about Comet.

HTTP Streaming on AJAXPatterns
Comet at Wikipedia
Meebo a Web Chat Platform
An elementary example at Ajaxif
LightStreamer a commercial server for Comet Apps, also available for ASP.NET now

What is AJAX?

noreply@blogger.com (Zeeshan Qadir) — Mon, 26 Nov 2007 16:55:00 +0000

I have been among the interviewers at my work places for 50+ technical interviews, at different stages, for different positions, ranging from positions requiring fresh graduates to 4-5 years experienced resources. Out of all those interviews, I can count those good ones on fingers who correctly answered “What is AJAX?” So I consider it a worth sharing information, “What actually AJAX is”.

If you have any of the below questions in your mind, then I would recommend you to continue reading this post.

Is it a tool?
Is it a language?
Is it a technology?
Is it a library?
Is it a technique?
What’s so special about AJAX?
What’s working behind the scenes in AJAX?
Can’t we do the same trick if we don’t have the XMLHttpRequest object available in browsers?
Can’t we make an AJAX request synchronous?
How comes AJAX improve the responsiveness of a Web Application?
Is the round-trip eliminated in case of AJAX?
When to use AJAX?

Here are the points one needs to remember about AJAX, so as to have a clear understanding of what it actually is, what’s working behind the scenes, what are it’s alternates, when to use it and when not to use it.

“AJAX stands for Asynchronous JavaScript and XML”.
“AJAX is a technique” to make web applications more responsive, by enabling the application developers to “seamlessly make a request to the server without the need to Post Back the complete page” in order to provider better user experience.
AJAX is a “mix of JavaScript, HTML, CSS, DOM, XML/JSON”
The core object that’s working behind the scenes to seamlessly make a request to the server and is available in all modern browsers is “XMLHttpRequest / Microsoft.XMLHTTP”.
There are “many libraries/frameworks written on top of this XMLHttpRequest / Microsoft.XMLHTTP” object that facilitate the AJAX based development. ASP.NET AJAX is one of those 100s of frameworks available for free to the ASP.NET developers to incorporate AJAX features in their ASP.NET based web applications.
“We can make a synchronous requests” with XMLHttpRequest too.
“We can do a similar trick as of AJAX by using the old & gold HTML Frames (a 0 sized frame)” and use Java Script to change the “src” attribute of that 0 sized frame based on some user action, to make a seamless request to the server, without the need to post back the actual page shown in the frame actually visible to the end use, and once the requested page in 0 sized frame is loaded, you can use JavaScript to manipulate the contents of the actually visible Frame to reflect the data actually fetched from the server in that 0 sized frame. This is the technique which I used back in 2002, on the SOFTEC 2003’s, Macromedia Flash 5 based website, to submit a data entered by the user in a flash based form, to the server without posting back the page in which the Flash movie was loaded so as to provide the best possible user experience to the end user.
AJAX makes the application responsive by seamlessly sending an XMLHTTP request to the server without the need to post back the complete page. “By wisely using AJAX you can decrease the network traffic (and in turn increase the responsiveness) by just sending the request (and optionally the parameters) to the server and getting just the required data from the server and eventually displaying it to the end user in a neat fashion using JavaScript + HTML + DOM + CSS”.
AJAX “doesn’t eliminate the round-trip to the server”; it’s not like that all the data required by the page is sent to the client side when the page is first rendered, using such approach (might) result in performance hit (in most cases). It’s actually an “on-demand fetching of the required data based on user actions / timers in a seamless fashion to provide a better user experience”.
“Use AJAX in order to improve the user experience”. Keep the end use of your web application in mind, while you are engineering the application. This is the real key to make a successful web product / application.
“Use AJAX in order to minimize the overall network traffic” created by your web application.
“Don’t use AJAX to the extent that makes the response of your web application un-predictable for an end user”.

I will be providing a quick review of ASP.NET AJAX and its Programming Models in a week or so, keep your fingers crossed.

Secrets of Internet Marketing with Google – Google AdWords

noreply@blogger.com (Zeeshan Qadir) — Mon, 26 Nov 2007 09:04:00 +0000

A couple of weeks back, I attended a seminar on “Secrets of Internet Marketing with Google” at my university; LUMS.

The session started with case studies on Google’s AdWords, presented by CEOs / Technical Consultants of

ShopHive
CottonSocks
LumenSoft
Bramerz

After that Badar Khushnood; Country Consultant of Google Pakistan at Google Inc., presented an enlightening and quite a convincing presentation on the said topic.

I knew from quite some time that Google shows relevant Sponsored Text Ads with search results but I never knew that even a person like me can design a marketing campaign, at an affordable cost, using Google AdWords.

I heard quite a few surprising facts of internet marketing with Google at the seminar and would like to share some of those with you so that you can use it too to increase the market share of your products / services.

“ShopHive” a Pakistani Shopping portal with monthly revenue of around 5 Million Rs is using Google AdWords and have a bigger competitive edge on “MyShop” because of the targeted audience.
“CottonSocks” is reaching its targeted audience for exports by using Google AdWords and is happy with the overall cost / benefit ratio; same is the case with “LumeSoft”.
Google “doesn’t charge you just for displaying your Ads” in the sponsored Ads panel in its search results. You will be only charged when any user browsing the search results actually clicks on your Ad.
There is a “cost associated with per user click (CPC)” on your Ad and that depends on word you have chosen against which your Ad will be shown to the user who searches on that word or any of the related word.
You can reach your “Targeted Audience” with Google AdWords. You can design your marketing campaign such that your Ads will be displayed only to those users browsing the web from a particular geographical area e.g. you can limit that your Ads should be displayed to only those users who are browsing the search results from Lahore only.
You can tailor “any number of Ads” to be displayed in the sponsored links panel of Google Search Results.
You can display your Ad as the sponsored links on the Google Search Results page with daily expenditure of as low as 1$ i.e. 60 Rs only, which is far low as compared to any other medium of advertising and is much more effective. In essence you can “define you daily budget for the Ads” to be displayed.
Google also offers “certifications in Google AdWords” which one can opt for as a consultant to attract more and more companies to get consultation from him/her.

ExtJS 2.0 - Making Web applications more responsive with minimal network traffic!

noreply@blogger.com (Zeeshan Qadir) — Sun, 25 Nov 2007 13:21:00 +0000

It has been quite long that I have been working on engineering responsive web applications using Microsoft ASP.NET and related technologies.

Although the use of Update Panel can do the wonders to make a traditional ASP.NET Application a bit more responsive but I have always been eager to make the application responsive with minimal network traffic and that’s not the case when we use the ASP.NET AJAX Update Panel.

So I personally prefer the Client Centric Programming Model of ASP.NET AJAX (the PageMethods approach) in which you only transfer the required data and not the complete UI. And in this case when you transfer just the required data and not the complete UI, you are stuck on how to present the data in a good enough fashion. For that you need the command on Java Script + HTML DOM, but even when you have command on all this JavaScript + CSS stuff, making a “GridView” kind of thing to show the data using Java Script is hell of a task.

This is where ExtJS comes in, to serve the purpose. ExtJS is basically a JavaScript based UI framework and provides sufficient enough controls through which you can fulfill the data presentation needs of your applications.

The ExtJS controls range from HTML Control extenders (text, button, text area, select list) to a full fledged grid controls (with built-in client side sorting, column reordering, column hide/show, grouping, inline editing, deletion and what not) which can be 2 way-binded to multiple kinds of data sources (JSON, Arrays, XML etc), and quite amazingly all this is done in JavaScript.

A quick walkthrough on how to bind the data returned from server to an ExtJS based Grid is outlined below.

Get the data from the server (like getting a list of Employee type of objects i.e. List) using the ASP.NET AJAX Page Methods.

Define the ExtJS based “Record” that maps the Employee type of C# Class objects to an ExtJS based employee “Record” type.

Define the ExtJS based “JsonReader” and associate that reader with the employee “Record” type you have just defined in Ext JS.

Define the ExtJS based “Store” and load the returned List in that store using the reader you have already defined.

Now you can bind this ExtJS based “Store” to any ExtJS based “GridPanel” or Select list or can use the store as a temporary data place holder for further manipulation later on.

The tricky part is to read the returned List of Employees in “JsonReader” and load it in “Store”, once the data is loaded in the Store, you can bind it to any data bound ExtJS control or can manipulate it later on.

On request of one of the readers; Imtiaz, here is the sample code of the above walkthough. [Added: 14/12/2007]

The code sample is updated to incorporate JavaScript IntelliSense for ExtJS in Visual Studio 2008 SP1 and is available here. [Added: 17/08/2008]

ExtJS is compatible with all the modern browsers, and can be used for free under open source license or under a commercial copy-left license. For more details on licensing, refer to the ExtJS website. i.e. http://www.extjs.com/

A few sample UIs (snapshots of ExtJS examples) made with the ExtJS UI Framework are shown below to give you an idea of what we can get out of ExtJS.

Quarter Break + Annual Leaves

noreply@blogger.com (Zeeshan Qadir) — Sat, 24 Nov 2007 20:25:00 +0000

Finally it’s the end of another quarter of my MS-CS at LUMS & from yesterday onwards I am on annual leaves from office till the 1st week of December 2007.

Along with my other plans on how to spend these holidays, like spending some healthy time with my parents, I plan to update my blog with my experiences so far; old + new including but not limited to stuff like Comet, AJAX+ASP.NET AJAX 1.0, FxCop, Firebug + YSlow, SandCastle, MVC Framework for ASP.NET, C#3.0/3.5, Web Client Software Factory, Provider Model, Google AdWords etc. Let’s see how much successful I am in sharing some really exciting information on the said topics I have learnt through my experience working in these.

What’s new in Microsoft .NET 3.0 & .NET 3.5?

noreply@blogger.com (Zeeshan Qadir) — Mon, 05 Nov 2007 16:04:00 +0000

I came across this comprehensive diagrammatic representation that will definitely clarify what’s new in .NET 3.0 & .NET 3.5. The main point to remember is that both the .NET 3.0 and .NET 3.5 are built on top of .NET 2.0.

.NET 3.0 adds four frameworks namely Windows Communication Foundation (WCF), Windows Workflow Foundation (WF), Windows Presentation Foundation (WPF) and Card Space to .NET 2.0 and Microsoft named the resulting framework as .NET 3.0 (a marketing tactic).

Similarly .NET 3.5 adds Language Integrated Query (LINQ), Representational State Transfer (REST) and AJAX functionality to .NET 3.0 and named the resulting framework as .NET 3.5.

Considerations for High Performance Websites

noreply@blogger.com (Zeeshan Qadir) — Thu, 13 Sep 2007 09:01:00 +0000

Steve Souders has jolted down fourteen simple tips and tricks to improve website performance.

Make fewer HTTP requests
Use a CDN
Add an Expires header
Gzip components
Put CSS at the top
Move JS to the bottom
Avoid CSS expressions
Make JS and CSS external
Reduce DNS lookups
Minify JS
Avoid redirects
Remove duplicate scripts
Turn off ETags
Make AJAX cacheable and small

You can download his complete presentation on the said topic at Web 2.0 Expo conference from here

For a detailed description of each of the above 14 tips refer to Exceptional Performance section at Yahoo Developer Network.