3 posts tagged with "asp-net"

While working today I thought I would try out caching a partial view action in my controller. Seems like an easy enough thing and was described as one of the nice new features of MVC 3 release. I quickly ran into issues in my assumption of how this feature would work, and went to the Usual Suspects for trying to figure out what happened.

Now lets get one thing out… The feature works, but it has a couple hidden gotchas that took a while to figure out.

Have you gotten this error on a web farm sharing forms authentication recently?

Forms authentication failed for the request. Reason: The ticket supplied was invalid

Normally this is a no-brainer, just make sure you have the same machine key settings across servers, but recently I ran into this while setting up a new server and was honestly befuddled for an hour trying to figure out what I had missed. After scouring the back alley’s of google-bing, I finally hit on the right keyword mojo and found this nugget on stackoverflow.com. You remember that security vulnerability found last fall, yeah forgot about that one too, well I guess one of the side effects of the patch was that un-patched servers don’t play nice with each other. Here is a quote from the Gu himself that explains it clearly:

Because the patch modifies the encryption/signing behavior of certain features in ASP.NET, it is important that you apply it to all machines in a web-farm. If you have a mix-match of patched/un-patched systems you’ll have forms-authentication, webresource.axd, and scriptresource.axd requests succeed/fail depending on which server they hit in the farm (since the encryption used would be different across them).

So what are you waiting for, go patch that server!

I’m willing to bet as a web developer there will be some project that you are working on that requires you to expose your data and or services across domain boundaries through an REST API and want them to be called via javascript. Maybe you wrote a jQuery plugin that retrieves data from your site, or maybe you have several domains that share the same services. Whatever the reason is, you will quickly discover the browser same-origin policy, which states “a web page served from domain1.com cannot normally connect to or communicate with a server other than domain1.com”.

Fortunately there is a way around this. It’s called JSONP or “JSON with padding”. To summarize, JSONP works around the cross-domain browser restriction by making a GET request using a script tag, which isn’t limited by the same-origin policy. It traditionally will also provide a callback method in the url so the response from the server will look something like this: