Cross Origin Resource Sharing (CORS)

Cross Origin Resource Sharing (CORS) is a W3C standard that allows a server to relax the same-origin policy. Using CORS, a server can explicitly allow some cross-origin requests while rejecting others. CORS is safer and more flexible than earlier techniques such as JSONP.

he general mechanics of CORS are such that when JavaScript is attempting to make a cross-origin AJAX call the browser will “ask” the server if this is allowed by sending headers in the HTTP request (for example, Origin). The server indicates what’s allowed by returning HTTP headers in the response (for example, Access-Control-Allow-Origin). This permission check is done for each distinct URL the client invokes, which means different URLs can have different permissions.

In addition to the origin, CORS lets a server indicate which HTTP methods are allowed, which HTTP request headers a client can send, which HTTP response headers a client can read, and if the browser is allowed to automatically send or receive credentials (cookies or authorization headers). Additional request and response headers indicate which of these features are allowed.

Permission/Feature	Request Header	Response Header
Origin	Origin	Access-Control-Allow-Origin
Http Method	Access-Control-Request-Method	Access-Control-Allow-Method
Request Headers Response Headers	Access-Control-Request-Headers	Access-Control-Allow-Headers Access-Control-Expose-Headers
Credentials		Access-Control-Allow-Credentials
Cache preflight Response		Access-Control-Max-Age

Technorati Tags: CORS,Web API

Display Modes

Display modes use a convention based approach to allow selecting different views based on the browser making the request.

For example, if a desktop browser requests the Home page, the application might use the Views\Home\Index.cshtml template. If a mobile browser requests the Home page, the application might return the Views\Home\Index.mobile.cshtml template.

There are two ways to create a custom display mode. The first way is to instantiate the DefaultDisplayMode class and set the ContextCondition property. The second way is to create a class that inherits from the DefaultDisplayMode class and set the ContextCondition property in the constructor.

Technorati Tags: Display modes,ASP.NET MVC

Microsoft Fakes

A mocking framework enables you to provide a fake implementation of a type or object, along with logic that verifies how calls were made to the mocked object. There are several good mocking frameworks currently available in the community, including Moq, Rhino, and NMock. Although these tools have strong followings and a good reputation, there was still a need to provide a mocking framework to customers who may be unable to utilize open source or third-party tools. Hence, the Microsoft Fakes framework in Visual Studio 2013.

The Fakes framework is derived from the Moles project by Microsoft Research. The Fakes framework is not backward-compatible with Moles, but the migration is straightforward.

Stubs are concrete implementations of interfaces and abstract classes that can be passed into the system being tested. A developer provides method implementations via .NET delegates or lambdas. A stub is realized by a distinct type that is generated by the Fakes framework. As such, all stubs are strongly typed. You cannot use stubs for static or non-overridable methods. Instead, you should use shims in those instances.

Shims are runtime method interceptors. They enable you to provide your own implementation for almost any method available to your code in .NET, including types and methods from the .NET base class libraries.

Task	Stub/Shim	Reason
Performance	Stub	The runtime code-rewriting used by shims introduces some performance issues at runtime. Stubs do not do this.
Static Methods	Shim	Stub can only influence overridable methods. They cannot be used for static, non-virtual, and sealed virtual methods.
Internal Types	Stub/Shim	Both stubs and shims can be used with internal types made accessible through the InternalsVisibleToAttribute attribute.
Private Methods	Shim	Shim types can replace private methods if all the types on the method signature are visible.
Interfaces/Abstract Methods	Stub	Stubs implement interfaces and abstract methods that can be used for testing. Shims can't do this because they don't have method bodies.

Technorati Tags: Microsoft Fakes,Shims,Stubs

Accept Header and Content Types

The Accept header tells the server what your client wants in the response.

The Content-Type header tells the server what the client sends in the request.

httpClient.DefaultRequestHeaders.Add("Accept", "application/json");
httpClient.DefaultRequestHeaders.Add("Content-Type", "application/json");

Technorati Tags: .NET,ASP.NET MVC

How to display errors during development with MVC?

Gets a value indicating whether custom errors are enabled for the current HTTP request.

protected override void OnException(ExceptionContext filterContext)
{
	WriteLog(Settings.LogErrorFile, filterContext.Exception.ToString());

	//custom error page
	if (filterContext.HttpContext.IsCustomErrorEnabled)
	{
		filterContext.ExceptionHandled = true;
		this.View("Error").ExecuteResult(this.ControllerContext);
	}
}

This flag is controlled by the customErrors section in web.config. If the customErrors element’s mode attribute is set to On, IsCustomErrorEnabled returns True. If the CustomErrors element’s mode attribute is set to False or RemoteOnly, this flag is set to false.

Technorati Tags: MVC,Custom Errors