Website Review - ASP.NET

Pitfalls¶

• Multi-line textboxes don't enforce the MaxLength property. To compensate, use the TextBox Class.
  

• Apostrophes — When (1) the target of a hyperlink or (2) any portion of JavaScript code is generated from user-provided data, be sure to compensate for apostrophes in the data by following these guidelines.
  

• JavaScript confirm function — Fix a quirk with the JavaScript confirm function by replacing it with the confirmExt function found here.
  

Usability and Administrative¶

• Remove files that aren't used.
• Ensure the site degrades gracefully without JavaScript support.
• Ensure the logo at the top of the page is a hyperlink to the home page.
• Ensure every page has a control with the initial focus.
• Ensure the submit button on every page responds to the Enter key.
  

Security¶

General¶

• Encrypt the connection string in the web.config file, according to this procedure.
  

• Write stored procedures using the WITH EXECUTE AS DBO clause.
  

• Grant the user in the connection string minimal rights to the database: no SELECT rights on tables or views; no VIEW DEFINITION on any code objects; just EXECUTE rights on all stored procedures.
  

• Handle exceptions on every page with a Page_Error() event handler
  1. Use Server.GetLastError to get the exception object
  2. Use Server.ClearError to avoid the bubbling up of exceptions
     

• In global.asax, write an Application_Error() procedure.
  

Preventing Denial-of-Service Attacks¶

Performance Tweaks¶

General¶

• Disable viewstate on any page not needing it.
  

Pipeline¶

<httpModules>
    <remove name="OutputCache" />
    <remove name="Session" />
    <remove name="WindowsAuthentication" />
    <remove name="FormsAuthentication" />
    <remove name="PassportAuthentication" />
    <remove name="UrlAuthorization" />
    <remove name="FileAuthorization" />
    <remove name="ErrorHandlerModule" />
    <remove name="AnonymousIdentification" />
</httpModules>

Process Configuration¶

<system.net>
    <processModel 
        enable="true" 
        timeout="Infinite" 
        idleTimeout="Infinite" 
        shutdownTimeout="00:00:05" 
        requestLimit="Infinite" 
        requestQueueLimit="5000" 
        restartQueueLimit="10" 
        memoryLimit="60" 
        webGarden="false" 
        cpuMask="0xffffffff" 
        userName="machine" 
        password="AutoGenerate" 
        logLevel="Errors" 
        clientConnectedCheck="00:00:05" 
        comAuthenticationLevel="Connect" 
        comImpersonationLevel="Impersonate" 
        responseDeadlockInterval="00:03:00" 
        responseRestartDeadlockInterval="00:03:00" 
        autoConfig="false" 
        maxWorkerThreads="100" 
        maxIoThreads="100" 
        minWorkerThreads="40" 
        minIoThreads="30" 
        serverErrorMessageFile="" 
        pingFrequency="Infinite" 
        pingTimeout="Infinite" 
        asyncOption="20" 
        maxAppDomains="2000" 
     />
     <connectionManagement>
          <add address="*" maxconnection="100" />
     </connectionManagement>
     

Profile/Membership Provider¶

• Add applicationName attribute in Profile Provider.
  

<profile enabled="true"> 
<providers> 
<clear /> 
<add name="..." type="System.Web.Profile.SqlProfileProvider" 
connectionStringName="..." applicationName="YourApplicationName" 
description="..." /> 
</providers> 

• Turn off automatic profile saving, and do saves manually via Profile.Save();.
  

<profile enabled="true" automaticSaveEnabled="false" >

• Cache roles. (This won't work for users with many roles, which exceeds the 2KB cookie limit.)
  

<roleManager enabled="true" cacheRolesInCookie="true" >

• When querying Membership tables, do NOT use Email or UserName in the WHERE clause; instead, use LoweredEmail and LoweredUserName, which are indexed.
  

• When querying Membership tables, ALWAYS include an ApplicationId in your WHERE clause to avoid table scans.
  

• Rework the aspnet_Profile_GetProfiles procedure. It doesn't need a temp table (which spikes I/O usage), and could probably do without the LIKE LOWER(@UserNameToMatch) in the WHERE clause.
  

CREATE PROCEDURE [dbo].[aspnet_Profile_GetProfiles]
   @ApplicationName nvarchar(256),
    @ProfileAuthOptions int,
    @PageIndex  int,
    @PageSize   int,
    @UserNameToMatch   nvarchar(256) = NULL,
    @InactiveSinceDate datetime = NULL
AS

IF @UserNameToMatch IS NOT NULL 
BEGIN
        SELECT u.UserName, u.IsAnonymous, u.LastActivityDate, p.LastUpdatedDate,
      DATALENGTH(p.PropertyNames)
        + DATALENGTH(p.PropertyValuesString) + DATALENGTH(p.PropertyValuesBinary)
      FROM    dbo.aspnet_Users u
        INNER JOIN dbo.aspnet_Profile p ON u.UserId = p.UserId
      WHERE u.LoweredUserName = LOWER(@UserNameToMatch)
   
        SELECT @@ROWCOUNT
END

ELSE
    BEGIN -- Do the original bad things

    DECLARE @ApplicationId uniqueidentifier
    SELECT @ApplicationId = NULL
    SELECT @ApplicationId = ApplicationId
                FROM aspnet_Applications
                    WHERE LOWER(@ApplicationName)
                            = LoweredApplicationName
    
   IF (@ApplicationId IS NULL)
        RETURN
 
   -- Set the page bounds
    DECLARE @PageLowerBound int
    DECLARE @PageUpperBound int
    DECLARE @TotalRecords   int
   SET @PageLowerBound = @PageSize * @PageIndex
   SET @PageUpperBound = @PageSize - 1 + @PageLowerBound
 
    -- Create a temp table TO store the select results
    CREATE TABLE #PageIndexForUsers
    (
      IndexId int IDENTITY (0, 1) NOT NULL,
      UserId uniqueidentifier
    )
 
    -- Insert into our temp table
   INSERT INTO #PageIndexForUsers (UserId)
       
      SELECT u.UserId 
        FROM    dbo.aspnet_Users
            u, dbo.aspnet_Profile p 
      WHERE   ApplicationId = @ApplicationId 
            AND u.UserId = p.UserId       
                AND (@InactiveSinceDate
                IS NULL OR LastActivityDate
                        <= @InactiveSinceDate)
                AND (   
                    (@ProfileAuthOptions = 2)
                OR (@ProfileAuthOptions = 0 
                        AND IsAnonymous = 1)
                OR (@ProfileAuthOptions = 1 
                        AND IsAnonymous = 0)
                    )
                AND (@UserNameToMatch
                IS NULL OR LoweredUserName
                    LIKE LOWER(@UserNameToMatch))
        ORDER BY UserName
 
    SELECT u.UserName, u.IsAnonymous, u.LastActivityDate,
      p.LastUpdatedDate, DATALENGTH(p.PropertyNames)
      + DATALENGTH(p.PropertyValuesString) 
      + DATALENGTH(p.PropertyValuesBinary)
    FROM    dbo.aspnet_Users
                    u, dbo.aspnet_Profile p, #PageIndexForUsers i
    WHERE   
      u.UserId = p.UserId 
      AND p.UserId = i.UserId 
      AND i.IndexId >= @PageLowerBound 
      AND i.IndexId <= @PageUpperBound
 
    DROP TABLE #PageIndexForUsers
 
    END
END

Use AJAX¶

• Use AJAX to load content on an as-needed basis.
  

• Cache AJAX calls, remembering that only HTTP GET calls can be cached; HTTP POST calls can't be cached.
  

[WebMethod][ScriptMethod(UseHttpGet=true)]
public string CachedGet()
{
    TimeSpan cacheDuration = TimeSpan.FromMinutes(1);
    Context.Response.Cache.SetCacheability(HttpCacheability.Public);
    Context.Response.Cache.SetExpires(DateTime.Now.Add(cacheDuration));
    Context.Response.Cache.SetMaxAge(cacheDuration);
    Context.Response.Cache.AppendCacheExtension(
           "must-revalidate, proxy-revalidate");

    return DateTime.Now.ToString();
}

Browser Cache¶

• Cache static content for as long as possible (e.g., 30 days) via IIS Manager > website properties > HTTP Headers tab > Expire after 30 days.
  

• Reuse common graphics files from the same folder, rather than multiple folders.
  

• Store the URL for each static file in a configuration setting, using querystring parameter to indicate the date/version of a static file. For example, to access ~/images/logo.png, have a configuration setting point to ~/images/logo.png?ver=20091029 for the 10/29/2009 version. When you update the logo.png file, update the configuration setting with the new date, and browsers will be forced to get a new copy of the image.
  

• Store static files in a different domain. (The browser can open two concurrent connections; and you won't be sending cookies for all the static files in the dynamic content requests.)
  

• Minimize SSL usage, as it is not cached.
  

• Generate Content-Length response headers. Otherwise, the browser keeps the connection open as long as it's getting data till the connection closes.