ASP.NET 4.5, ASP.NET MVC 4 and ASP.NET Web Pages 2, along with a few side frameworks that are not really part of the official .NET Framework package, bring new capabilities to Microsoft-based Web development that allow ever more scalable and immersive browser-based experiences.
In late October, Microsoft corporate vice president Scott Guthrie announced via his blog that .NET 4.5, and thus ASP.NET 4.5, were available for use in Windows Azure websites. Given that many of Microsoft’s own properties have been slower than expected in adopting the latest version, this is welcome news as an indicator that this version of ASP.NET is solid even in a shared environment, and it enables scale as advertised. The Azure team is more cutting-edge than most, but they also cannot afford to let the systems they run bog down.
Shrinking things down
One set of capabilities that help deliver on better performance is full support in the framework for Bundling and Minification. This can improve request load time by reducing the chattiness of too many page element requests. The Bundling feature combines JavaScript or CSS file requests, minimizing the overhead of each request and also getting around the fact that modern browsers will only allow a set number of simultaneous requests (typically six at a time). Fewer requests usually will improve page load performance. Minification optimizes the contents of the JavaScript or CSS files to remove white space and to rename variables to very short names, and also allows removing comments from the text. When combined with Bundling, this can make a big difference in user satisfaction.
A minor problem affecting the learning curve for those not used to writing JavaScript directly is the lack of IntelliSense in Visual Studio for JavaScript code. ASP.NET 4.5 and Visual Studio 2012 have remedied this situation. This sounds like only a small improvement to those who know JavaScript like the back of their hand and to those who have not written much JavaScript,
but the vast majority of developers fall in the middle and will appreciate this change. Meanwhile, the NuGet package manager, while not really a feature of ASP.NET 4.5, has become a staple for Web developers since it became the underlying engine of the Microsoft Web Platform Installer in late 2010.
SignalR is a feature I have been hoping to see myself. SignalR allows developers to quickly and easily call on libraries to push data to all connected browsers. It plays very well in situations where you want to build a dashboard, such as a project-management system where multiple browser-connected users are making changes at the same time. If you have seen the penny auction sites where auctions are held second by second, this is the kind of immediate feedback that can be accomplished with the new framework.
SignalR works with WebSockets and lots of JavaScript. It is not revolutionary, but it will enable a much larger portion of developers to include push notifications into their solutions. The example that is most often provided to show how this works is a browser-based chat room, but if you followed the recent elections in the United States, you likely saw websites that updated results without page refreshes. This is becoming more and more of an expected functionality.
Page Inspection is a new feature that Scott Hanselman, principal program manager at Microsoft, demonstrated during his part of the keynote at the company’s BUILD conference in late October. The idea behind this feature is that pages are getting more and more complicated and cluttered. Page Inspection lets you mouse over elements of the page UI, and the code that renders that element is brought into view and highlighted. This is the logical next step to having design and HTML views both up in Visual Studio, and as you select an item in one, the other syncs your selection.
Sometimes features are included in the beta of a product, but do not release with the product and instead either are left on the cutting room floor of product management, or are released out of band and then live or die on their own schedule. Microsoft took the single-page application (SPA) functionality (including the templates) out of ASP.NET MVC for the final release of version 4. We expect it to live on, but as a NuGet package. The SPA model is getting popular and does its magic by heavily leveraging the Knockout and Upshot script libraries. While technically not a feature of ASP.NET 4.5, you will still see it mentioned in the same breath often due to how it made its debut in the beta, but was then pulled before final release.
#!
ASP.NET MVC 4
The latest version of MVC adds to the already powerful feature set laid down by the previous versions, and includes a number of mobile development capabilities, a Web API and (to follow into the whole theme set for .NET 4.5) support for asynchronous methods. ASP.NET MVC has been moving rapidly in the journey to make it a first-class alternative to ASP.NET Web Forms. An important part of that progress is mobile application support. To that end, mobile project templates are included, and support for JQuery Mobile is also available.
One of the biggest additional capabilities that have been added to MVC in this round also helps with mobile projects: the ASP.NET Web API. As the name indicates, the Web API lets developers create HTTP services and control them in great detail. Web API services are easily testable, and support routes, request and response manipulation with a strongly typed object model and code-based configuration.
In previous versions of MVC, the role that the Web API is meant to serve has been typically managed using controller actions. This approach works, but Web API helps round out the rough edges by allowing easier support for various serialization formats. The Web API brings the flexibility and power without the weight that has put so many developers off of using Windows Communication Foundation. With Web API, projects that are offering services are less forced and avoid artifacts that do not really help get the job done.
Several of the demonstrations at the BUILD conference highlighted federating authentication by leveraging OpenID and OAuth to login via Facebook and other platform providers. MVC supports this, as do other components of ASP.NET in this new version. Task Support for Asynchronous Controllers, and support for the Azure SDK in MVC 4, also both play into Microsoft’s themes for development for Windows 8. Microsoft is pushing the notion of fast and fluid experiences, which async functionality enables by preventing the UI from bogging down with synchronous tasks.
Putting the data in an Azure-based cloud is a cornerstone of the way Windows 8-style applications are meant to work. For these reasons, MVC is the best option to complement a Windows 8-targeted system since it can provide both the Web interface and the Web services consumed by the WinRT applications.
ASP.NET Web Pages 2
In order to compete with the various emerging platforms, Microsoft has created alternatives that all leverage the same underlying base represented by ASP.NET and the .NET base class libraries. We see this in the continued support and improvements made to Web Forms and with MVC. Yet even with these options there was a missing part of the landscape, which is that niche where PHP and even Classic ASP reside.
To cover this often-ignored, but very real, requirement, Microsoft introduced WebMatrix and the concept of ASP.NET Web Pages. Meant to be lightweight and even simple to be constructed with Notepad, ASP.NET Web Pages leverage the Razor templating engine. ASP.NET Web Pages 2 builds on that base and brings with it extra capabilities, showing that Microsoft is continuing to pursue their high, medium and low strategy with ASP.NET. Some of the updated capabilities in this iteration include mobile-friendly page rendering, new input validation options via the Validation object, easy integration of maps from various providers, and better membership and authentication options that include support for Facebook and other sites that use OpenID and OAuth.
#!
ASP.NET security
Before .NET 4.5 was released, there were ways to make claims-based identity work by using Windows Identity Framework (WIF) and plugging things together, but now the functionality that made up WIF is baked into the framework, and even into Windows 8 and Windows Server 2012. Dominick Baier from Thinktecture went over the details in an interview on the .NET Rocks Podcast with Carl Franklin and Richard Campbell. (The specific episode is available at .NET Rocks {http://www.dotnetrocks.com/default.aspx?showNum=772} for those who want to get deeper into the details.)
This inclusion of WIF functionality is a significant change as it shows that security is a big part of the improvements being applied to ASP.NET development as a whole. In the process of integrating WIF into the .NET Framework, there have been a number of changes. For example, there is a LocalSTS in Visual Studio 2012, the Add STS Reference menu option is now built into Visual Studio, and the sample projects for WIF are now part of the Visual Studio Gallery.
There have also been changes in the objects that provide the functionality. All principal classes serve claims, and the classes from Microsoft.IdentityModel have been moved into System namespaces. By providing standards-based support for authentication via WS-Trust and WS-Federation, authentication is maturing and should be easy to do.
Cross-site scripting (XSS) attacks are among the most common exploits being carried out against users in recent years. The problem is that they tend to target the users of systems rather than the systems themselves. This is great news for operators of Web applications, provided they do not care about their users. So, vulnerable system allows the hacker to cause the user to submit inputs that can strike at the user’s system or pass the hacker valuable information. AntiXSS has been around for a while and allows you to encode input to defeat these kinds of exploits. The class Microsoft.Security.Application namespace in the independent tool, but is in the System.Web.Security.AntiXss namespace as part of ASP.NET 4.5. The object of interest is AntiXssEncoder, and it can be mapped to the encoderType setting in the Web.config file of a Web application to cause the application to leverage the library automatically.
Running off of Windows
The discussion about developing on ASP.NET always seems to lead to the question of cross-platform considerations. Choosing to write an application on ASP.NET is not ceding support for non-Windows platforms, but it does raise the question as to whether this approach represents a compromise taken too far. Because ASP.NET applications in all flavors emit HTML and JavaScript to the client, there is no reason that they cannot be accessed from iOS devices, Android devices or even Linux clients of various stripes.
The issue is whether that is an inferior model that leads to too many compromises at the user-experience level. To flesh out this perspective, I talked with Joseph Hill, COO and cofounder of Xamarin. He stressed right from the start that Xamarin is focused on products rather than platforms. Its primary goal is not to provide an environment to host ASP.NET on non-Windows platforms, but rather to use offerings like MonoTouch to let developers use the language that works best for the job for the platform of their choice.
Hill explained, “Write once, run everywhere is not what we are trying to do.” He and the rest of the team at Xamarin believe that C# is a superior language. He said that the company is providing the “best story out there for consuming ASP.NET Web services,” and he talked about developers who use Mono sharing 80% of their code across platforms and then tailoring the final 20% to the platform. Many cross-platform solutions embrace the write-once, run-everywhere goal, but in almost all cases that path leads to leveraging HTML. He pointed out that Facebook’s Mark Zuckerberg said HTML was a mistake on mobile because of the performance issues. This is an argument for native over HTML solutions.
For those C# developers that agree that native is the way to go, MonoDevelop is an attractive solution. Even with MonoDevelop, iOS development must be done on a Mac.
Though it is not Visual Studio, the Xamarin IDE is a C# IDE that Hill described thusly: “Anyone who uses Visual Studio would feel comfortable and immediately be productive MonoDevelop.” For Android development, you can just use the Visual Studio Add-in “Mono for Android” that allows targeting of a non-Windows platform with C# and Visual Studio.
#!
ASP.NET in the trenches
There are many consultants that live and breathe the ASP.NET platform, and others that just dabble in ASP.NET development as needed. We talked to a number of the former to see how the pace of releases and the accompanying improvements have helped them deliver for their clients.
I talked to Microsoft regional director for Australia and 2011 ALM MVP Adam Cogan about the role of ASP.NET—and more specifically ASP.NET 4.5—in how his company, SSW, delivers solutions. Many of the solutions SSW builds have a content-management component. In recent years, there has been an explosion of Content Management Solutions (CMS) available, including the open-source CMS Orchard offered by Microsoft, WordPress, Sitefinity and Embarcadero. WordPress is not a .NET-based solution, and when asked about that, he said, “There has been lots of WordPress growth in the CMS world, but for solutions with lots of business rules, customers know they can’t go back to a development environment where it is hard to maintain vast qualities of logic.”
For that reason they have gravitated toward Sitefinity from Telerik. Cogan explained that while he and SSW have tried using other solutions, they have settled into using Sitefinity thanks to its support for MVC. That is because MVC 4 was the big story for SSW. He stated, “We have found the switch from ASP.NET Web Forms to MVC 4 for the latest projects to really reduce time because of reduced testing and debugging.”
This is a common theme, as many of the more advanced developers have embraced MVC since its introduction. Some cited testability, while others required sites to be optimized for search engines. Both require control, which is where MVC excels. Introducing MVC to ASP.NET provided an alternative to ASP.NET Web Forms without replacing it, leaving developers to choose their tool of choice.
For another perspective, I talked to Andrés Fontán, founder and chief architect of Alcuadrado S.A., a Colombian ISV market leader of back-office software for stock-trading firms. Fontán, like Cogan, has been a Microsoft Regional Director since 1997. Alcuadrado is using the full array of Microsoft developer technologies, and Fontán was very excited about the new features in ASP.NET 4.5, such as SignalR. He said that his company has used it to “develop some very innovative solutions for our customers. There are a lot of new and interesting solutions that you could build with this technology.”
User experience is where the buzz has been over the last couple of years thanks to Apple and now Microsoft ringing that bell. Solution providers such as Fontán are trying to balance between delivering better user experiences while maintaining developer productivity. Often, the biggest concern from developers faced with supporting iOS is the desire to not have to descend into Objective-C. This has raised interest in solutions that promise cross-platform deployment without straying from familiar development environments, such as Visual Studio and C#.
Fontán discussed where the market was in terms of the popularity of ASP.NET as the development platform of choice. He said, “I don’t have good numbers, but I feel that in our [South American] market, a lot of Web development is done with ASP.NET.” I asked him why he and his company prefer to stick with ASP.NET rather than other platforms such as straight HTML5. He replied, “Because it is fast, open, scalable, well-documented and supported, improves fast, and we have found it easy to recruit many developers that know it. Now that we are moving some apps to the cloud using Azure, we found that ASP.NET is the right choice.”
I later talked to Duane Laflotte, CTO of CriticalSites, a Boston-based consultancy specializing in Web development and security. He said that while his company does do security penetration testing for sites and systems written with a whole range of technologies, they do “most development with Microsoft technology, whether that is C++ or ASP.NET with C#.”
While MVC improvements are of interest, Laflotte was more interested in Web APIs specifically rather than MVC as a whole. Ultimately, elements of ASP.NET 4.0 that made life better for Azure development and security were the top priority in this case. “I am in favor of anything that makes it more likely that the developers who work for our customers will do more of the right things and less of the wrong things with regard to security first and scale second,” he said.
Laflotte went on to say that the separation of concerns Web API provides, the choice of tools to fit the task (i.e. MVC, ASP.NET Web Pages and Web Forms), and improvements in the overall authentication models have “allowed developers to do more with higher quality in terms of both security and experience.”
All of the solution providers interviewed felt that the new features in ASP.NET 4.5 are helping them build better, more secure and more competitive solutions while preserving the productivity they demand and expect by using Visual Studio. Perhaps the most interesting observation to be made after talking to this disparate group is that specialization is becoming clearer even within ASP.NET developers. When ASP.NET first came to market just after the turn of the century, everyone developing Web applications with ASP.NET was using Web Forms, since it was the only game in town. Now, with so many choices and flavors, the landscape is full of specialties and deep expertise.
The evolution of .NET
The early versions of the .NET Framework were like most products from Microsoft, in that follow-on versions provided incremental updates and improvements to a baseline of capabilities. Starting with .NET 3.0, that tradition was augmented with new versions providing fixes for bugs, but also bolting on major additions to the framework.
This is how Windows Communication Framework, Windows Presentation Framework and many other expansions came to be part of the .NET Framework. A major benefit to this practice was that all the versions up to 4.0 could be run side by side. Unlike previous versions of .NET, versions 4.0 and 4.5 of the framework are not side-by-side compatible with each other. Instead, systems with .NET 4.0 must be upgraded to 4.5 to take advantage of the new features and fixes. Yet, in some cases, this can cause changes in what had been familiar behaviors.
SSW’s Cogan voiced the complaints of many over this aspect. He said, “I find it frustrating that .NET 4.5 is not able to run side by side with .NET 4.0. As a result, code you write and test can perform differently in production, depending on if the server has .NET 4.0 or .NET 4.5 on it.”
