Contents
The history of ASP.NET 14
ASP.NET Core 3 features 16
What is new specifically to ASP.NET Core 3? 17
Cross-platform support 19
Microservice architecture 21
Working with containers 22
Performance and scalability 22
Technology restrictions 23
Common technologies not directly found in ASP.NET Core and .NET Core 24
When to choose ASP.NET Core 3 24
Summary 25
Visual Studio 2019 as a development environment 27
How to install Visual Studio 2019 Community Edition 28
First steps with Visual Studio 2019 32
Creating your first ASP.NET Core 3 application in Visual Studio 2019 36
Creating your first ASP.NET Core 3 application via the command line 41
Basic debugging with Visual Studio 2019 43
Breakpoints 45
Call stack 46
Autos, Locals, and Watch Panes 47
Visual Studio Code as a development environment 47
How to install Visual Studio Code on Linux 49
Creating your first ASP.NET Core 3 application in Visual Studio Code 52
Creating your first ASP.NET Core 3 application in Linux 54
Introduction to the C# Interactive and LINQPad tools 56
Summary 58
Technical requirements 60
CI, CD, and build and release pipelines 60
Using Azure DevOps for CI and CD 61
Creating a free Azure DevOps subscription and your first Azure DevOps project 62
Organizing your work via work items 64
Understanding the scrum process 66
Using Git as a VCS 71
Using feature branches 77
Merging changes and resolving conflicts 79
Creating an Azure DevOps build pipeline 83
Creating an Azure DevOps release pipeline 87
Summary 88
Preview of the Tic-Tac-Toe demo application 91
Building the Tic-Tac-Toe game 92
Conceiving and implementing your first Tic-Tac-Toe feature 93
Targeting different .NET Core versions in the .csproj files of your projects 97
Using the Microsoft.AspNetCore.App metapackage 98
Introduction to the default ASP.NET Core 3 classes 99
ASP.NET Core 3 start up classes 100
Working with the Program class 100
Working with .NET Generic Host instead of WebHostBuilder 102
Working with the Startup class 103
Preparing the basic project structure 105
Creating the Tic-Tac-Toe home page 107
Giving your web pages a more modern look by using NPM and layout pages 112
Updating the layout page 115
Creating the Tic-Tac-Toe user registration page 119
Creating the Tic-Tac-Toe user service 122
Using DI to encourage loose coupling 122
Creating the user service 123
Creating a basic communication middleware for the Tic-Tac-Toe application 127
Working with middleware 127
Creating the communication middleware 130
Working with static files 132
Using routing, URL redirection, and URL rewriting 134
Endpoint routing for ASP.NET Core 3 137
Adding error handling to the Tic-Tac-Toe application 138
Summary 144
Client-side development using JavaScript 146
Preliminary email confirmation functionality 147
Email confirmation by our user 149
Using XMLHttpRequest 153
Optimizing your web applications and using bundling and minification 158
Bundling and minification in action 159
Working with WebSockets for real-time communication scenarios 163
WebSockets in action 164
Taking advantage of session and user cache management 168
In-memory session providers 169
Distributed session providers 173
Applying globalization and localization for multi-lingual user interfaces 174
Globalization and localization concepts 174
Using the view localizer 181
Localizing Data Annotations 184
Configuring your applications and services 188
Adding an email service 188
Configuring the email service 190
Implementing advanced dependency injection concepts 194
Method injection 194
Summary 201
Client-side development using C# Razor components 203
Working with SignalR 207
What is SignalR 207
SignalR with server-side Blazor or Razor components 208
Using logging and telemetry for monitoring and supervision purposes 209
Building once and running on multiple environments 221
Summary 227
Understanding the Model View Controller pattern 229
Models 230
Views 231
Controllers 231
Unit tests 231
Integration tests 232
Creating dedicated layouts for multiple devices 232
The layout page in more detail 233
Optimizing for mobile devices 236
Understanding ASP.NET Core state management 241
Client-state management options 242
Hidden fields 242
Cookies 242
Query string 243
Query string usage 243
Server-based state management options 244
Application state 244
Session state 244
Using view pages, partial views, View Components, and Tag Helpers 245
Using view pages 246
Using partial views 253
Using View Components 254
Using Tag Helpers 260
Dividing a web application into multiple areas 266
Applying advanced concepts such as view engines, unit tests, and integration tests 270
Using view engines 270
Providing better quality by creating unit tests and integration tests 277
Adding unit tests 282
Adding integration tests 286
Layering ASP.NET Core 3 applications 288
Determining the required layers 289
Deciding on the distribution for layers and components 290
Determining rules for interactions between layers 290
Identifying cross-cutting concerns 291
Summary 291
Technical requirements 294
Applying web API concepts and best practices 294
Building RPC-style web APIs 296
Building REST-style web APIs 312
Building HATEOAS-style web APIs 321
Securing your web API 323
ASP.NET Core web API help pages with Swagger/OpenAPI 324
Summary 328
Establishing a connection 333
Defining primary keys and foreign keys via Data Annotations 336
Using Entity Framework Core 3 migrations 340
Creating, reading, updating, and deleting data 344
Understanding data relationships 346
Primary key 346
Foreign key 347
One-to-one relationships 348
One-to-many relationships 348
Many-to-many relationships 349
Working with queries 350
Querying for one item 350
Querying for all items 351
Querying for filtered items 351
Using transactions 352
Summary 353
Implementing authentication 355
Adding basic user form authentication 369
Adding external provider authentication 377
Working with two-factor authentication 380
Two-factor authentication - step by step 381
Adding forgotten password and password reset mechanisms 390
Implementing authorization 399
Summary 408
Cross-Site Scripting (XSS) 410
Preventing XSS 411
Cookie stealing 412
Preventing cookie stealing 412
Eavesdropping, message tampering, and message replay 413
Preventing eavesdropping and message replay 413
Open redirects/XSR 414
Open redirects example 414
Preventing open redirects 415
SQL injection 415
Preventing SQL injection 415
Protecting SQL connection strings 416
Using the Persist Security Info default value in connection strings 416
Using object-relational mappers (ORMs) 416
Cross-Site Request Forgery (XSRF/CSRF) 417
XSRF/CSRF example 417
Preventing XSRF/CSRF 418
Domain referrers 418
User-generated tokens 419
Limitations 420
JS/JSON hijacking 420
Preventing JSON hijacking 420
Over-posting 420
Vulnerability example 421
Preventing over-posting 421
Clickjacking 422
Clickjacking example 422
Preventing clickjacking 422
Proper error reporting and stack trace 424
Error reporting vulnerability example 425
Preventing a screen of death 425
Summary 426
Hosting applications 428
Deploying applications in AWS 430
Deploying applications in AWS Elastic Beanstalk 433
Getting the application running on AWS 445
Deploying applications in Microsoft Azure 458
Deploying applications in Microsoft Azure App Service 462
Getting an Azure App Service instance running 462
Publishing your code on Azure 468
Continuous integration with Azure Repos 469
Connecting the database 472
Deployment through the Web Deploy tool 479
Deploying applications into Docker containers 482
Deploying applications into Docker containers 483
Publishing images to Docker Hub 491
Summary 494
Logging in ASP.NET Core 3 applications 496
Logging in Microsoft Azure 497
Enabling Microsoft Azure App Service 498
Logging in AWS 505
Monitoring ASP.NET Core 3 applications 508
Monitoring on-premises and in Docker 509
Monitoring in Microsoft Azure 512
Monitoring in AWS 528
Summary 533
Other Books You May Enjoy 534
Index 537
Preface
Every day, software developers, application architects, and IT project managers work on building applications as quickly as possible in order to be leaders in their respective markets: time-to-market (TTM) is of utmost importance. Unfortunately, the quality and performance of those applications are often not as expected, since they have not been fully tested, optimized, and secured.
During the past few years, ASP.NET has evolved into becoming one of the most consistent, stable, and feature-rich frameworks available on the market for web application development. It provides all expected characteristics you can think of concerning performance, stability, and security out of the box.
For some time now, the IT market has been changing. Compliance with different standards is now required and customers expect industrialized, high-performing, and scalable applications, while developers ask for frameworks that allow higher productivity and extensibility to adapt to specific business needs. Accordingly, this has led Microsoft to completely rethink its web technologies.
As a result, Microsoft has built ASP.NET Core, which gives developers the capacity to do the following:
- Create applications and compile them in a specific environment, but then run
- them in any environment (such as Linux, Windows, or macOS).
- Use third-party libraries with additional functionalities.
- Work with various tools, frameworks, and libraries.
- Adopt the most up-to-date best practices for frontend development.
- Develop flexible, responsive web applications.
ASP.NET Core 3, together with Microsoft Visual Studio 2019, includes several features to make your life as a web developer easier and more productive. For example, Visual Studio offers project templates that you can use to develop your web applications. Visual Studio also supports several development modes, including using Microsoft Internet Information Services (IIS) directly to test your web applications during development time and using a built-in web server to develop your web applications over FTP.
With the debugger in Visual Studio, you can run through your application and step through the critical areas of your code to find problems. With the Visual Studio editor, you can effectively develop your own custom user interfaces.
And when you are ready to deploy your application, Visual Studio makes it easy to create a deployment package for deployment on Azure, Amazon Web Services, and Docker, or any other platform including Linux and macOS. These are but a few of the features built into the ASP.NET Core framework when paired with Visual Studio.
This book provides the latest best practices and ASP.NET Core guidance to get you up to speed quickly. Each section of this book presents specific ASP.NET Core 3 features in an easily readable format with detailed examples. The step-by-step instructions yield immediate working results. Most of the key features of ASP.NET Core are illustrated using succinct, easily understandable, and reusable examples. The examples are in-depth, in order to illustrate features without being overbearing.
In addition to showing ASP.NET Core features by example, this book contains practical applications of each feature so that you can apply these techniques in the real world. After reading this book and applying the exercises, you will have a great head start into building efficient web applications that include modern features, such as MVC architectures, web APIs, custom view components, and tag helpers. We hope this book will help you in your daily job as a developer and that reading it will give you as much joy as writing it has given us.
The following is a little bit of history to explain how .NET Framework has evolved over the years and why you have to consider the .NET Core framework today:
Microsoft started working on what we know now as .NET Framework in the late 1990s, and released a first beta version of .NET Framework 1.0 in late 2001.
Originally, the framework was named NGWS for Next Generation Windows Services (with an internal codename of Lightning/Project 42). In the beginning, developers could only use VB.NET as a programming language. More than 10 Framework versions later, a lot has been achieved. Today, you can choose between a large number of languages, frameworks, and technologies.
In the beginning, InterDev was the primary development environment to develop ASP pages, and you had to use a command-line VBC compiler tool to compile your code.
The first version of our beloved Visual Studio development environment was published in February 2002, bringing with it a common runtime environment for the Windows client and Windows server family (NT 4, Windows 98, Windows ME, Windows XP, and then Windows 2000).
Around the same time, Microsoft provided a lighter framework, named Compact Framework, to execute Windows CE on Windows Mobile. The last version was published in January 2008 as version 3.5 RTM before it was replaced by newer mobile technologies.
The first .NET SDK was published in April 2003 as .NET Framework 1.1 and was included in Visual Studio 2003. It was the first version to be included in the Windows Server OS and shipped together with Windows 2003.
.NET Framework 2.0 was released in January 2006 during the time of Windows 98 and Windows Me. It provided a major upgrade to the Common Language Runtime (CLR). It was the first version to fully support 64-bit computing and fully integrate with Microsoft SQL Server. It also introduced a new Web Pages Framework, providing features such as skins, templates, master pages, and style sheets.
.NET Framework 3 (WinFX) was released in November 2006. It included a new set of managed code APIs. This version added several new technologies to build new types of applications, such as Windows Presentation Foundation (WPF), Windows Communication Foundation (WCF), Windows Workflow Foundation (WWF), and Windows CardSpace (later integrated into Windows Identity Foundation).
.NET Framework 3.5 extended the WinFX features one year later, in 2007. This version included key features such as LINQ, ADO.NET, ADO.NET Entity Framework, and ADO.NET Data Services. Furthermore, it shipped with two new assemblies that would later be the foundation of the MVC framework: System.Web.Abstraction and System.Web.Routing.
.NET Framework 4.0 was published in May 2009; it provided some major upgrades to the CLR and added a parallel extension to improve support parallel computing, dynamic dispatch, named parameters, and optional parameters, as well as code contracts and the BigIntegerComplex numeric format.
After the release of .NET Framework 4.0, Microsoft released a set of improvements to build microservices in the form of the Windows Server AppFabric framework. Essentially, it provided an in-memory distributed cache and an application server farm.
.NET Framework 4.5 was released in August 2012; it added a so-called Metro-style application (which later evolved into Universal Windows Platform applications), the Core features, and the Microsoft Extension Framework (MEF).
Concerning ASP.NET, this version was more compatible with HTML5, and jQuery, and provided bundling and minification for improved web page performance. It was also the first to support WebSockets and asynchronous HTTP requests and responses.
.NET Framework 4.6.1 was released in November 2015; it required Windows 7 SP1 or later, and was an important version. Some of the new features and APIs included were support for SQL connectivity for AlwaysOn, Always Encrypted, and improved connection resiliency when using Azure SQL databases. It also added Azure SQL Database support for distributed transactions using the updated System.Transactions APIs and provided many other performance-, stability-, and reliability-related fixes in RyuJIT, GC, and WPF.
.NET Framework 4.6.2 was released in March 2016; it added support for paths longer than 260 characters, FIPS 186-3 DSA in X.509 certificates, and localization of data annotations, and the resources files were moved to the App_LocalResources folder. Additionally, the ASP.NET session provider and local cache manager were made compatible with the asynchronous framework.
.NET Framework 4.7 was released in April 2017; it was included in the Windows 10 Creators update. Some of the new features included enhanced cryptography with elliptic curve cryptography and improved Transport Layer Security (TLS) support, especially for version 1.2. It also introduced the object cache store, which enabled developers to provide custom providers easily by implementing the ICacheStoreProvider interface.
There was also a better integration between the application and the memory monitor and the famous memory limits reactions, which enables developers to observe the CLR when it truncates objects cached in memory and overrides the default behavior. Then, Microsoft developed a completely new .NET Framework with open source multiplatform in mind from the beginning. It was introduced as ASP.NET 5 and later renamed ASP.NET Core Framework.
The first release, 1.0, was announced by Richard Lander (MSFT) in June 2016; the ASP.NET MVC and web API frameworks were merged into a single framework package that you could easily add to your projects via NuGet.
The second release, .NET Core Framework 1.1, was published in November 2017; it ran on more Linux distributions, its performance was improved, it was released with Kestrel, the deployment on Azure was simplified, and the productivity was improved. Entity Framework Core started to support SQL Server 2016.
The latest release of the .NET Core framework at the time of writing this book is 3, released in September 2019. A first preview version was released in late 2018 and subsequent multiple previews since the beginning of the year (2019). Microsoft has vastly improved the .NET Core framework. The improvements and extensions are the results of the vision for .NET Core 3; it enables you to use more of your code in more places.
It is worth noting that most of the regular libraries are available on GitHub. They can be forked and rebuilt by anyone who wants to extend or change any standard behaviors.
Who this book is for
This book is for developers who would like to build modern web applications using ASP.NET Core 3. No prior knowledge of ASP.NET or .NET Core is required. However, basic programming knowledge is assumed. Additionally, previous Visual Studio experience will be helpful but is not required, since detailed instructions will guide you through the samples of the book. This book can also help people who work in infrastructure engineering and operations to monitor and diagnose problems during the runtime of ASP.NET Core 3 web applications.
What this book covers
This book is organized into chapters that explain ASP.NET Core 3 features in an easy and understandable format with practical examples. Most of the key features of ASP.NET Core 3 are illustrated using succinct, efficient examples and step-by-step instructions to yield immediate working results.
You don't have to read the chapters in any order to find the book useful. Each chapter stands on its own, except for the first chapter, which details the fundamentals of ASP.NET Core—you might want to read it first if you've never ventured beyond desktop application development.
The following topics will be covered throughout the book.
Chapter 1, What Is ASP.NET Core 3?, describes the features and functionalities of ASP.NET Core 3, but also the technical restrictions, which should allow you to understand in which cases it could be a good fit for your own needs and what to expect.
Chapter 2, Setting Up the Environment, gives a detailed explanation of how to set up your development environment and how to create your first ASP.NET Core 3 application. You will learn how to either use Visual Studio 2019 or Visual Studio Code, how to install the runtime, and how to use NuGet to retrieve all necessary ASP.NET Core 3 dependencies.
Chapter 3, Continuous Integration Pipeline in Azure DevOps, demonstrates how to set up a complete Azure DevOps Continuous Integration Pipeline. You will learn how to fully automate building, testing, and deploying your applications using Azure DevOps in the cloud.
Chapter 4, Basic Concepts of ASP.NET Core 3 via a Custom Application: Part 1, explains the basic structure and concepts of ASP.NET Core 3 applications. It shows how everything works internally and what classes and methods can be used to override basic behavior. It also provides the theoretical background for all the other chapters.
Chapter 5, Basic Concepts of ASP.NET Core 3 via a Custom Application: Part 2, following up on the concepts covered in Chapter 4, Basic Concepts of ASP.NET Core 3 via a Custom Application: Part 1, delves deeper into essential ASP.NET Core 3 concepts. You will learn about the components and features offered by ASP.NET Core to build responsive web applications.
Chapter 6, Introducing Razor Components and SignalR, gives an introduction to Blazor, a new offering by Microsoft to cater for frontend development using C# as a language. It prepares you with the basics that you need to be aware of what is being offered in working with server-side Blazor.
Chapter 7, Creating ASP.NET Core MVC Applications, provides all the concepts and everything necessary to create your first ASP.NET Core 3 MVC application. You will learn the specifics of MVC applications and how to implement them efficiently. Additionally, you will see how unit tests and integration tests will help you build better applications with fewer bugs, resulting in lower maintenance costs.
Chapter 8, Creating Web API Applications, covers the web API framework and provides everything essential to create your first ASP.NET Core 3 web API. You will see different web API styles, such as RPC, REST, and HATEOAS, and learn when to use them and how to implement them in an effective way.
Chapter 9, Accessing Data Using Entity Framework Core 3, shows how to access databases using Entity Framework Core 3, while using all the advanced features (code first, the Fluent API, data migrations, in-memory databases, and more) it offers.
Chapter 10, Securing ASP.NET Core 3 Applications, explains how to use the built-in ASP.NET Core 3 features for user authentication and how to extend them by adding external providers. If you need to secure your applications, then this chapter is where you want to go.
Chapter 11, Securing ASP.NET Applications - Vulnerabilities, gives us an indication of what we need to be aware of when building our applications, in terms of areas that can be exploited, and therefore need more attention.
Chapter 12, Hosting ASP.NET Core 3 Applications, is about the various options you have when it comes to hosting and deploying your ASP.NET Core 3 web applications onpremises and in the cloud. You will learn how to choose the appropriate solutions for a given use case, which will allow you to make better decisions for your own applications.
Chapter 13, Managing ASP.NET Core 3 Applications, is finally going to be a chapter on how to manage and supervise your production-ready applications after deployment. It will greatly aid you in diagnosing problems for your ASP.NET Core 3 web applications during runtime and reduce the time to understand and fix bugs.
To get the most out of this book
You will either need Visual Studio 2019 Community Edition or Visual Studio Code, which are both free of charge for testing and learning purposes, to be able to follow the code examples found within this book. You could also use any other text editor of your choice and then use the dotnet command-line tool, but it is advised to use one of the development environments mentioned earlier for better productivity.
Later in the book, we will work with databases, so you will also need a version of SQL Server (any version in any edition will work). We advise using SQL Server 2019 Express Edition, which is also free of charge for testing purposes.
There might be other tools or frameworks that will be introduced during the following chapters. We will explain how to retrieve them when they are used. If you need to develop for Linux, then Visual Studio Code and SQL Server 2016 or 2019 are your primary choices, since they are the only ones running on Linux. Additionally, you will need an Azure subscription and Amazon Web Services subscription for some of the examples shown within the book. There are multiple chapters dedicated to showing you how to take advantage of the cloud.
