MSDNEvents_Spring2007_AJAXBestPractices

Best Practices for Building Next Generation Web Applications Using Microsoft ASP.NET AJAX : 

Best Practices for Building Next Generation Web Applications Using Microsoft ASP.NET AJAX MSDN Events http://www.msdnevents.com

What We Will Cover : 

What We Will Cover Common Pitfalls Best Practices Prescriptive Guidance

Agenda : 

Agenda Introduction Extensibility and Maintenance Accessibility Scalability Security

Using AJAXBenefits and Concerns : 

Using AJAXBenefits and Concerns Benefits Richer application functionality Better end-user experiences Decreased bandwidth utilization Improved scalability Concerns Increased complexity for developers Increased attack surface

AJAX Architecture : 

AJAX Architecture DOM, JavaScript, CSS, XML, JSON, etc. C#, VB.NET, ASPX, XML, SQL, etc.

Developer Checklist : 

Code Extensibility and Maintenance Accessibility Scalability Security Developer Checklist

Agenda : 

Agenda Introduction Extensibility and Maintenance Accessibility Scalability Security

Code Maintenance : 

Code Maintenance General Coding Best Practices Design patterns and idioms Refactoring Unobtrusive Client-Side Coding Separate behavior from structure Similar to how CSS separates style from structure

Unobtrusive Coding - Benefits : 

Unobtrusive Coding - Benefits Benefits Less coupling yields less brittle code Less coupling yields better re-use through encapsulation Behaviors can degrade more gracefully Unobtrusive Coding Yields:

Unobtrusive ASP.NET AJAX : 

Unobtrusive ASP.NET AJAX

Agenda : 

Agenda Introduction Extensibility and Maintenance Accessibility Scalability Security

AJAX and Accessibility : 

AJAX and Accessibility What is Accessibility? Problems with AJAX and Accessibility Dynamic Nature Partial-page reloads Asynchronous update to UI using Web Services and AJAX calls. Visual Nature Rich visual UI Cool ‘effects’

Mitigation Strategies : 

Mitigation Strategies User Notification Dampening Alerting / Notifications Validation By real users who use real assistive technologies Progressive Enhancement / HIJAX

Addressing Accessibility with ASP.NET AJAX : 

Addressing Accessibility with ASP.NET AJAX

Agenda : 

Agenda Introduction Extensibility and Maintenance Accessibility Scalability Security

Update Panels and Web Services : 

Update Panels and Web Services Update Panels Easy to leverage Only requires server side coding Stateful Requires a full post-back Synchronous (last request wins)Requires a full post-back Use when you need state or server-side logic. Web Services Lightweight Asynchronous / parallel execution Finer control Harder to Implement Requires client-side codingUse when your logic/data is stateless or when you need fine control

Optimizing UpdatePanels : 

Optimizing UpdatePanels Size and Scope Limit scope and number Avoid enclosing static content Optimizations Conditional updates Triggers

Optimizing AJAX Partial Page Postbacks : 

Optimizing AJAX Partial Page Postbacks

Micro-Caching : 

Micro-Caching Server side caching with ASP.NET AJAX applications deliver more responsive UIs and ‘dynamic’ data Cached data that has become “stale” is not acceptable Consider the definition of stale 2 minutes? 20 seconds? 2 seconds? Solution: Micro-Caching Cache for short periods of time Middle ground between always up-to-date and stale data

Using Micro Caching : 

Using Micro Caching

Agenda : 

Agenda Introduction Extensibility and Maintenance Accessibility Scalability Security

Security Best Practices : 

Security Best Practices Trust nothing—validate everything Separate control from data Adhere to the Defense In Depth principle Use secure transmissions as needed Reduce attack surfaces

Common Validation Failings : 

Common Validation Failings Failure to validate at the server Client-side only validation is NOT security. Validation techniques Blacklisting Complex Treacherous Whitelisting Intuitive Secure

Addressing common validation concerns : 

Addressing common validation concerns

Securing Access and Communications : 

Securing Access and Communications Remember Use Authorization schemes Protect sensitive information Easy Use Sys.Services.AuthenticationService

Other Security Best Practices : 

Other Security Best Practices Disable error messages Don’t disclose useful information to malicious users Reduce attack surfaces Remove non-used interfaces and Web methods Turn of WSDL and/or .DISCO where possible

Hardening Web Services : 

Hardening Web Services

Session Summary : 

Session Summary Remember Best Practices Remember to Optimize Update Panels Take Security Seriously Consider Accessibility

Resources : 

Resources Microsoft ASP.NET AJAX http://ajax.asp.net MSDN Events Resources http://www.msdnevents.com/resources

Slide 30: 

MSDN Events http://www.msdnevents.com