IIS For Developers

IIS 7 / 7.5

• Version of IIS is always tied to version of OS.
• Modularity of IIS 7 /7.5: You chose modules of IIS which are to be installed.
• SSL Site: A unique IP address is required for SSL enabled web site.IIS cannot use Host name to distinguish, because host name is encrypted when IIS handles request.
• Starting IIS 7 certain settings are saved in Application’s web.config file.Each App pool has one worker process.
• Starting IIS 7: When you create a new web site, IIS creates a new App pool of exact same name.
• Managed Pipeline mode:  Use Integrated mode if possible.
• Unhandled exceptions lead to App pool to crash.
• Any type of configuration change leads to an App pool to recycle.
• Session state is saved in App pool. So when App pool is recycled session state would be lost?  
• IIS Troubleshooting

                                    -  Find slow running pages in runtime using worker processes module
                                     - Track errors using Failed Request Tracing module

• Log Parser Wizard & Log Parser Tool are could be used to analyze log files. Log Parser Tool allows SQL like queries on log.
• MSDeploy is a tool from Microsoft for deploying web sites.
• MSDeploy could be used

                    - To sync two web servers.

                            - Take back-up of site on physical drive and vice versa.

                            - Since Visual Studio 2010. MSDeploy is built in to VS 2010.

• URL Rewrite extension: Could be used to give friendly URLs to user. This is IIS feature.
• Web Farm Framework: There is IIS extension which helps in Web Farm.

IIS 8

• Application Initialization: When first user shows up, lot of initialization happens. Application initialization allows this to be done before first user shows up. Thus first user won't take hit.
• SNI: Allows multiple SSL certificates to one IP Address.

.Net Regular Expression

Regular Expressions

• With .Net Regex you need to think about efficiency first.

• Regex class supports two flavors of Regular Expressions

1. Full featured .Net version
2. ECMA (JavaScript) version

• Outcome of Regex.Match can tell which part of subject matched which parts of pattern.

• Concatenation, Alternation (|), Repetition (*)

• Regex is immutable class.

• Regex finds leftmost match.

• Alternation: Order of terms in alternation is important (catnip|cat) will match catnip first and if this didn’t match then it will match cat.

• Repetition

1. Group a set of characters together using parenthesis for e.g. (cat)* matches all multiple occurrences of cat.
2.  (cat)* : Match 0 or more
3. (cat)? : Match 0 or 1
4. (cat)+ : Match 1 or more
5. (cat){1, 4}: Minimum 1 and maximum 4 occurrences are to be matched. 

Matching whole Expressions

• Match.NextMatch gives next match.

• (?m) : End modifier. This says that subsequent Regex is multiline regular expression.

• \A : Match start of the string. This is not affected by End modifier.

• ^: Same as \A if regular expression is not multiline. Matches subsequent pattern only at the start of new line.

• $: (Opposite of ^) When regular expression is not multiline, match should end with string end. When regular expression is NOT multiline, match should end with newline.

• \Z: (Opposite of \A) is not affected by End modifier. Match end of string.

• Custom character class e.g. [abc]

• Custom character class is more efficient than alternatives i.e. [abc] is more efficient than a|b|c. That’s why character classes are preferred over alternations if possible.

• Character class matches single character only.

• [a-z0-9] : All characters from a to z and 0 to 9

• [^a-z]: All characters except a to z. ^ is negation in this context.

• /d : [0-9]

• /D: [^0-9] (Note negation, so all characters except 0 to 9.

• /s: Any white space character

• /S: Negation of /s

• /w: a to z, A to Z, 0 to 9 and underscore and few more characters which are part considered to be part of English word

• /W: Negation of /w

• \w{3}: Match exactly 3 word characters

• \ is escape character. Regex.Escape method will add escape characters wherever necessary.

• \b: Word boundary. Matches with start or end of the word.

• \B: Negation of \b

• . (Dot): Wild character. Matches any character. By default won’t match New line.

• (?s) : Dot Modifier. (Dot) will match new line character as well. (:) colon is used to scope modifier to only one alternation pattern. For e.g. (?s: c.t) | d.g : Here modifier is applied only to first clause of the pattern.

• Avoid using operator * on . (dot) for performance reasons.

Thumb Rules for building secure web sites

1. Don't trust user input. 
2. Filter input as it comes in,  and accept only what you know is good. i.e Check for white box and black box.
3. Encode untrusted data before outputting it to your http stream.

Reference : "ASP.Net 3.5 Security" course on Pluralsight