|
Security is the first thing that comes to mind. When dealing with an internet based application you only expose what you absolutely need to. By exposing your presentation layer machine only you given yourself a small amount of risk. Now - no matter how much your server gets attacked - that is the only part of the business that will be affected. If there are other internal machines that rely on the business layer they will be able to use that business layer just fine while your internet users are the only ones having trouble.
Patrick Allmond
http://allaboutfocus.com
|
|
|
|
|
Would this be implemented using the .NET Remoting/Web Service option? It seems to me that if you expose the internal server using web protocols that it could be hacked.
Cleako
|
|
|
|
|
cleako wrote: because they have a way to tell the app to use the COM objects on another box
You could do the same thing with a ASP.NET web service and COM+ business objects. Although I fail to understand the benefit.
led mike
|
|
|
|
|
cleako wrote: What I dont understand is why go through all the trouble to take all of the business logic and place it on an App Server behind the fire wall and only do presentation code on the web server.
That's interesting, because I did some work for a company wanting to do the same thing. However, the reasoning there was to first develop an App server with a rich presentation client, then a web server as merely a different sort of rich presentation "client". In both cases, the business logic would be on the app server.
As to feasible, regardless of what technology you use, it's actually very difficult. They never succeeded. I think it's doable though.
Marc
Thyme In The CountryInteracxPeople are just notoriously impossible. --DavidCrow
There's NO excuse for not commenting your code. -- John Simmons / outlaw programmer
People who say that they will refactor their code later to make it "good" don't understand refactoring, nor the art and craft of programming. -- Josh Smith
|
|
|
|
|
Their thought is that it is safer having the business logic on the app server, but I thought that .NET took care of the security issue by building the code into DLLs.
Cleako
|
|
|
|
|
Isolating the business logic behind the firewall may be an attempt to reduce the attack surface of the application. The risk is that once a web server is attacked, the attacker can then discover the attack path through the firewall.
Another reason to use an n-tier infrastructure is to reduce the load on the web server.
The risk in this scenario is that a performance bottleneck can be created between web server and app server by relatively slow network technology.
.NET remoting does not require the HTTP protocol, and therefore, has no requirement for a web server. One way to think of .NET remoting is an evolution of the COM/DCOM model.
The risk here is that you are restricted to Microsoft technologies on both communication endpoints.
Web services requires a web server, and is restricted to the HTTP protocol.
If you really want to start to understand the ins and outs of n-tier development in relation to .NET, locate a copy of
"Microsoft® .NET Distributed Applications: Integrating XML Web Services and .NET Remoting" by Matthew McDonald copyright 2002
It references ASP.NET 1.x, and it provides examples of how to evolve a VB6/COM application to .NET.
This is an easier said than done process.
HTH,
onemorecoder
|
|
|
|
|
Is it necessary to encrypt viewstate from web.config even when SSL is being used? Does it provide any additional benefit or does it just slow down the server without any additional benefit?
Thanks,
Sam
|
|
|
|
|
Viewstate is already encrypted as is, the option to mess with it's encryption is to utilize a stronger routine.
I am not an absolute security expert but I know some things so i would suggest that anything you can keep on the server you keep there and just utilize the viewstate for holding the data of non-sensitive material. If you are accepting whether or not they like pizza, by all means use the viewstate, if you are taking an SSN, then you should probably grab that value and hold it in a session variable and replace it on the page with the bullets and dont even mean anything.
Cleako
|
|
|
|
|
ViewState is base64 encoding. SSL is encrypting the channel communications.
|
|
|
|
|
Keep in mind that viewstate also slows down the transmission time and increases the bandwidth usage because it makes your page larger. .NET holds the viewstate information in a hidden form field so the text for that data is sent on each page request. Because of this, the user could try to modify the viewstate and send it back - so keep sensitive data in the session or in some data store on the server.
|
|
|
|
|
Is there a security threat to ASPNET session id cookie for session hijacking even when SSL is used? Please advise. Also, same question for Forms Authentication Cookie.
Thanks,
Sam
|
|
|
|
|
Hi, im looking for a deployement strategie.
I've been looking into a few techniques, Windows installer and click once installer.
Both are nice but they bot have their downsides. The best technique would be one equal to suns JAVA runtime files (Just a webpage with a download and installation bar)
Requirements for the installation:
The application is based on the .NET framework 2.0;
The .NET framework 2 must be installed whenever the framework is missing.
A solution for installing under limited rights would be wonderfull!
An easy to edit configuration file of the setup project would be nice because there will be multiple instance of a single application ( This aint required or what )
I Hope i'm posting this in the right section,
Thanks already!
- Koen
|
|
|
|
|
Hello,
I'm designing an application that simulates a university application and courses system.
I'm looking for a design pattern for this case:
I have a base class Course, and 3 deriving classes for 3 type of courses.
each course should have a list of pre-courses that need to be taken in order to take the course. The pre courses can be any of the 3 types of courses.
I thought of using the graphic-shape-picture design pattern, but it's not the very same case.
Will appreciate any idea!
Thank You
Orlya
|
|
|
|
|
Maybe the "Course" class has a collection of Course class references or Course class unique id's.
led mike
|
|
|
|
|
Hi,
Any suggestions on how I can build an client/server architecture which has a browser-based RIA (Rich Internet Application using flex, .NET 3.0 or other) client and a server architecture that can run either on a web server (SOAP/Web services), or as an ordinary TCPIP-based application server. The option for deployment will be given the user at install time.
I understand that I need to write communication services for both options, but what is the optimal choice of technology/method?
The goal is to give the option to install the application on a standalone PC without IIS or any other web server installed, but still let the user interface be browser based.
Jay
|
|
|
|
|
|
Thanks. However, don't focus on the RIA part of my question. That is only to show that I want a "modern" browser-based UI experience. It is the dual-protocol communication strategy which is the interesting part to me. I want to have a web/internet application (default) to be able to run on a standalone computer environment which hasn't got a webserver installed.
Jay
|
|
|
|
|
We are having some communictions problems. You want an internet application without the internet? 
If you want to use a Web Browser interface for your UI in a desktop application you can use the WebBrowser control.
At this point I have no idea what you are trying to accomplish.
led mike
|
|
|
|
|
Jay
You need to be a little more clear on what you mean by web server and ordinary based TCPIP-based application server.
By web server I am assuming you literally mean a web server as in Apache or IIS. And TCPIP-based application serevr, I assume you mean Tomcat, Websphere, etc. Right?
I am currently creating an RIA using flex with a .NET backend.
dan
|
|
|
|
|
Hi Dan,
Yes, you are right with the first one: I mean web server as in Apache, IIS etc. The second one I simply mean a server application that can render the RIA client without running on a web server.
I will try to explain be telling you about the scenarios I see:
Scenario 1 (main): The user downloads the application and deploys it on a webserver, so that the application is available for all users on the intranet (through the RIA client)
Scenario 2: The user which will be one that decides that the application should be downloaded and tested on the company's own data before purchase, should be able to deploy it on his own computer/laptop as a standalone application with a database connection to the company's own production/test databases. This computer/laptop will normally not have any webserver locally installed and we cannot expect that the user will be interested or have the skills/patience to install the local IIS (or other Web server) before he can test the application. Therefore the application must be able to be deployed as a "standalone" configuration without a webserver to render the client.
I hope this clarified my requirements.
In the meanwhile I have found a class in .NET 2.0 (HttpListener) which can implement a web application without a web server.
I appreciate more comments and ideas.
Jay
|
|
|
|
|
i'm making an application in vb.net
i made the database and i need to go to the classes...
amy documentation can help me ?????
while i'm trying i faced a problem with foreing keys
ex :
table house (id,name,address)
table room (id,name,housid)
so i pass to class by wich way :
---------------------------------------------
1-
class house
- id as integer
- name as strind
- address as string
class room
-id as integer
-name as string
-hous as house
-----------------------------------------------
2-
class house
- id as integer
- name as strind
- address as string
- rooms () as room
class room
-id as integer
-name as string
-----------------------------------------------
3-
class house
- id as integer
- name as strind
- address as string
- rooms () as room
class room
-id as integer
-name as string
-hous as house
wich choice ...
if there are an alogrithm to make the pass from db to oo so can u help me ???
|
|
|
|
|
I go for #3.
from DB to OO, check http://www.mygenerationsoftware.com. My Number 1 choice.
|
|
|
|
|
opps
this is an application ...
i need to know the algos ....
if there are a documentation or something like that ...
thanks a lot
|
|
|
|
|
What you describe is a tree. Depending on the direction you want to go in the tree you should choose 2 or 3: 2 if you go from the root to leafs (you have the house and you want the rooms) or both ways (previous + you know the room and want to find the house it belongs). Choise 3 is more complete and memory used to keep the pointer to house is small 4B.
Usualy I do like this: a row in a table contains all the members of a class - each row = object; procedures that insert/update/delete in the database are methods of the class, each method calling corresponding stored procedure. Columns (members of classes) are accessed (read/write) through properties or functions offering a good consistency check even from the input of data.
|
|
|
|
|
Hi,
I´m developing a .NET 2.0 library (dll) which basically is a stamp clock that logs working time and prints job specifications. The application separates UI from logic by a library design approach. I plan to implement both a Windows Form UI and a AJAX UI on the library.
The question: What is a good design regarding how to store the logged time entries/data? Shall I store the data in a mdf database or XML files or make an interface an let the application that make use of the library (UI) implement the database interface to enable custom database usage (by doing this every implementation a database setup has to be carried out = bad)?
I know this depends on the purpose and usage. Is the mdf approach a good way to store data in both a webapplication and a desktop app? I find this a bit confusing. ^_^
Thanx in advance
regards
/Christoffer
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
