Asp.net class with security feature

To initiate a class if user is logged in with particular role.
For this purpose we need to add attributes on particular class.
eg.

 [PrincipalPermission(SecurityAction.Demand, Authenticated=true)]
 public class Authors
 {
     // Methods
 }

And the below code will prevent the "Authors" class from being instantiated during a request unless the incoming user is in the “Admin” role:


[PrincipalPermission(SecurityAction.Demand, Role="Admin")]
public class Authors
{
    // Methods
}

Introduction to Asp.net MVC3

ASP.NET MVC 3 enables richer JavaScript scenarios and takes advantage of emerging HTML5 capabilities.
The AJAX and Validation helpers in ASP.NET MVC 3 now use an Unobtrusive JavaScript based approach.  Unobtrusive JavaScript avoids injecting inline JavaScript into HTML, and enables cleaner separation of behavior using the new HTML 5 “data-“ attribute convention (which conveniently works on older browsers as well – including IE6). This keeps your HTML tight and clean, and makes it easier to optionally swap out or customize JS libraries.

ASP.NET MVC 3 now includes built-in support for posting JSON-based parameters from client-side JavaScript to action methods on the server.  This makes it easier to exchange data across the client and server, and build rich JavaScript front-ends.  We think this capability will be particularly useful going forward with scenarios involving client templates and data binding (including the jQuery plugins the ASP.NET team recently contributed to the jQuery project).

Previous releases of ASP.NET MVC included the core jQuery library.  ASP.NET MVC 3 also now ships the jQuery Validate plugin (which our validation helpers use for client-side validation scenarios).  We are also now shipping and including jQuery UI by default as well (which provides a rich set of client-side JavaScript UI widgets for you to use within projects).

Improved Validation:
Client-side validation is now enabled by default with ASP.NET MVC 3 (using an onbtrusive javascript implementation).

Output Caching

Previous releases of ASP.NET MVC supported output caching content at a URL or action-method level. With ASP.NET MVC V3 we are also enabling support for partial page output caching – which allows you to easily output cache regions or fragments of a response as opposed to the entire thing.

Other features:
Improved Add->View Scaffolding support that enables the generation of even cleaner view templates.
New ViewBag property that uses .NET 4’s dynamic support to make it easy to pass late-bound data from Controllers to Views.
Sessionless controller support that allows fine grained control over whether SessionState is enabled on a Controller.

NuGet:
NuGet enables developers who maintain open source projects (for example, .NET projects like Moq, NHibernate, Ninject, StructureMap, NUnit, Windsor, Raven, Elmah, etc) to package up their libraries and register them with an online gallery/catalog that is searchable.

Javascript Injection in MVC

ASP.net MVC (model view controller) by default open to javascript injections. It depends upon the developer how to protect their website from javascript injections. MVC provide options for the same but due to lazy coding or incomplete knowledge some of us avoid to use these.
Firs of all let us understand what is javascipt injection and how these injections affect our websites? There is a website in which we have two controllers named as "Insert" , "Details". Insert controller inserts input informatin of user (say user name) in database. Details controller used to dispaly information (that is saved by "Insert" controller) from database.
In view suppose i am using following code to display the user names:

<% foreach ( string userName in Model.UserNames) {%>
    <%# userName %>
<%}%>

In this case if a user ( not a normal user say intruder or hacker) inserts a script in datbase say: he inserts <script> alert('hiiii'); </script>. Our "Insert" controller doesn't detect this javascript code, It will consider it as a normal data. It will save it into the database. During display it will show an alert box on the screen. A smart or clever developer can also do this alerts in loop so that it will affect the functionality of website. This is a simple and small example of such javascript injection. Such type of injections can also be very dangerious.
Now let us discuss how we can protect our websites from such type of injections. A simple usage of "Html.Encode" function during displaying the user names. If  we use following code in view to display data then such scripting injections will not work.


<% foreach ( string userName in Model.UserNames) {%>
    <%# Html.Encode(userName) %>
<%}%>

We can also apply during insertion of data in "Insert" controller. By using "Html.Encode" it will convert the "<" into "&lt; and ">" to "&gt;". By doing this inserted javascript code will not work and website will work normally :)