Tag Info

Hot answers tagged

10

Suppose I have a server-side variable containing JSON, called strJSON that my own code created. Was it created entirely by your code? Are you certain that at no point does it add in a piece of user input? Are you also certain that at no point in the future will it ever be modified to add in data that comes from user input? If you can be 100% sure of ...


6

It's dangerously easy as a programmer to start thinking that every project you encounter could and should be done better (read: rewritten) because it doesn't correspond to your vision. We've ALL been there. You look at code and your mind just goes into "what's wrong with this"-mode, instead of focusing on what's right about it. If you start plucking away ...


3

If the JSON string is encoded entirely under your control, it is exploitable to the extent that your encoding method is broken. That said, you should be safe if you're performing a straightforward serialization using a trusted serializer, like so: var js = new JavaScriptSerializer(); var thingy123 = ThingyRepo.Get(123); var json = js.Serialize(thingy123); ...


2

Update: With more digging into this I came across Cephas Lin's excellent article and PDF of ASP.NET MVC 5's lifecycle. The PDF contains two images that clearly portray the flow of the MVC 5's lifecycle. The first gives a 10,000 foot perspective of it all. The second image is very detailed and much too large to share here. The first image: My ...


1

How about something like this? private static readonly object _syncRoot = new object(); [HttpPost] public void Post(InstagramUpdate instagramUpdate) { var subscriptionId = instagramUpdate.SubscriptionId; var lastUpdate = GetLastUpdate(subscriptionId); // To avoid breaking my Instagram request limit, do not fetch new images too often. if ...


1

I have another suggestion for the mechanism: when an update arrives, mark a subscription as having to update, and wait for your delay before making the update. That is, there is no need for a cache, you only need to store some state for each subscription id as "having to update" or not. I will use async because it makes the code pretty straightforward. For ...


1

Suppose you had made a User Control that you were going to use on many different pages. Part of the User Control is a link to the Home page. If you use the User Control on a page that is more than one level deep: i.e http://website/folder1/APageWithUserControlOn.aspx then this : <a href="./Home.aspx" runat="server"> Home </a> will resolve ...


1

For the edit/admin interface, a SPA is fine. For viewing the content, though I wouldn't recommend a SPA. Generally, you want to generate static pages from the content a user enters. This is faster/cheaper at runtime (serving static HTML is far easier than reading content from a DB and then rendering a page), and better for SEO. It's the approach used by ...


1

No, there is nothing wrong with evaluating your own code, if you know for certain it's safe. Too many get caught up in blindly following rules. Evaluation of code in a string seems to really bring out strong opinions for some reason. Evaluation of code in a string is a tool. Learn what it does, how it works, and why it can be unsafe. When you really ...


1

From Martin Fowler My First Law of Distributed Object Design: Don't distribute your objects Why opt to incur the overhead and instability of a web service if the business logic you want is in a DLL? Reference the DLL and keep all methods calls local, snappy and stable. If you were creating your web site in a non .NET language then you've got a good ...


1

It sounds like there's little difference in terms of coupling. If you're coding against the WebAPI directly, you're dependent on its interfaces. If you code directly against the DLL, you're dependent on its interfaces. Make the distinction irrelevant. Your application ideally shouldn't have to know or care whether it's ultimately leveraging a web service, ...


1

Using a Web API allows you to program to an interface rather than a concrete implementation. Need to generate an invoice (for example)? Just call the Web API method to generate that invoice. Should the need arise in the future to change the way invoicing works, you can just change the code behind the interface, (or swap it out for a completely different ...



Only top voted, non community-wiki answers of a minimum length are eligible