The clue is in the return types:

`AuthorizeCore` returns a boolean - it is *decision making* code. This should be limited to looking at the user&#39;s identity and testing which roles they are in etc. etc. Basically it should answer the question: 

`Do I want this user to proceed?` 

It should not perform any additional activities &quot;on the side&quot;.

`OnAuthorize` returns void - this is where you put any *functionality* that needs to occur at this point. e.g. Write to a log, store some data in session etc etc.

You should put any code that must run regardless of whether the user is being authorized for the first time, or if they are using a cached authorization in `AuthorizeCore`.  

If you look at the source code, you can see that `AuthorizeCore` gets called by both `OnAuthorize` and `OnCacheAuthorization`.  This allows the authorization to be cached but still allow certain actions and to make the actual decisions about the authorization.

If you need something from the AuthorizationContext then you can create a property to hold the information and then access that in the AuthorizeCore method.



For some inexplicable reason the `byte` primitive type is signed in Java.  This mean that valid values are -128..127 instead of the usual 0..255 range representing 8 significant bits in a byte (without a sign bit).

This mean that all byte manipulation code usually does integer calculations and end up masking out the last 8 bits.

I was wondering if there is *any* real life scenario where the Java `byte` primitive type fits perfectly or if it is simply a completely useless design decision?

----
EDIT:  The sole actual use case was a single-byte placeholder for native code.  In other words, not to be manipulated as a byte inside Java code.

-----

EDIT: I have now seen a place where an inner tight loop needed to divide by 7 (numbers 0..32) so a lookup table could be done with bytes as the datatype so the memory usage could be kept low thinking of L1 cache usage.   This does not refer to the signed/unsignedness but was a case of an actual usage.


Are there any real life uses for the Java _signed_ byte primitive type?

I want to be able to use sed to take an input such as:

    C:\Windows\Folder\File.txt

to

    C:/Windows/Folder/File.txt

Use sed to replace all backslashes with forward slashes

Using ASP.NET MVC I am creating a custom Authorize attribute to take care of some custom authorization logic.  I have looked at a lot of examples and it is pretty straight forward but my question is which method is best to override, AuthorizeCore or OnAuthorization?  I have seen many examples overriding one or the other.  Is there a difference?  

Extend AuthorizeAttribute Override AuthorizeCore or OnAuthorization

<p>Using ASP.NET MVC I am creating a custom Authorize attribute to take care of some custom authorization logic.  I have looked at a lot of examples and it is pretty straight forward but my question is which method is best to override, AuthorizeCore or OnAuthorization?  I have seen many examples overriding one or the other.  Is there a difference?</p>


I have the following:

    @if (Model.PageMeta.Sidebar == PageMetaSidebar.Small) { Html.RenderPartial(&quot;_SmallSidebar&quot;); }


and in my include file:

    &lt;style &quot;text/css&quot;&gt;
        #sbr { width: 193px; }
        #lft { left: 205px; top: 85px; right:  5px; bottom: 30px; }
        #top { left: 215px; top: 85px; right: 15px; }
        #btm { left: 215px; right: 15px; bottom: 30px; }
        #mdl { left: 215px; top: 85px; right: 15px; bottom: 30px; }
        @media print {
            div#lft {left:10px; right: 10px; top: 0px;}
            div#top {left:20px; right: 20px; top: 0px;}
            div#btm {left:20px; right: 20px; }
            div#mdl {left:20px; right: 20px; top: 0px;}
        }
    }
    &lt;/style&gt;

However this gives me a compile type error:

    _SmallSidebar.cshtml(7): error CS0103: The name &#39;media&#39; does not exist in the current context

Does anyone out there know how I could fix this so it accepts that @media is not something that needs to be evaluated?

How can I specify CSS @media within a razor file?

Or, should I rather ask, when will VS code formatting work properly for Razor markup? The formatting works for most structures, but it seems to choke on &#39;if&#39; blocks. The code below is as it is formatted by VS. It is very easy to fix this case, with one more indent, but I nicely accepted the formatting in everyday use, and like to use it often for the bulk of my code, so I&#39;d rather avoid manual formatting if possible. Right now I just leave it as VS formats it. 

    @{ 
        if (User.Identity.IsAuthenticated)
        {
        &lt;text&gt;Hello &lt;/text&gt;
        @Html.Display(&quot;@ViewBag.UserName&quot;) &lt;text&gt; - &lt;/text&gt;
        @Html.ActionLink(&quot;Sign Out&quot;, &quot;LogOff&quot;, &quot;Account&quot;, null, new { style = &quot;font-weight: bold;&quot; })
        }
     }

I think it&#39;s important for readability that, e.g. in the above, the body of the if block is indented, besides just looking nicer. 

Why doesn&#39;t Visual Studio code formatting work properly for Razor markup?

I&#39;m using ASP.NET MVC 3 and Entity Framework 4.1 Code First.

Let&#39;s say I have a `User` entity :

    public class User
    {
        public int Id { get; set; }
        public string Name { get; set; }
        public string Email { get; set; }
        public string Password { get; set; }        
    }

When editing it in my `UserController` I want to add a `PasswordConfirmation` field and verify that `PasswordConfirmation == Password` 

1. By composition
-----------------
My first try was :

    public class EditUserModel
    {
        [Required]
        public User User { get; set; }

        [Compare(&quot;User.Password&quot;, ErrorMessage = &quot;Passwords don&#39;t match.&quot;)]
        public string PasswordConfirmation { get; set; }
    }

In this case the client side validation &lt;del&gt;works but&lt;/del&gt; (**Edit:** client side validation working was a coincidence.) **doesn&#39;t work** and the **server side validation fails** with the following message : *Could not find a property named User.Password*

**Edit:** I think the best solution, in this case, would be to create a custom  `CompareAttribute`

**Implementing `IValidatableObject`**

    public class EditUserModel : IValidatableObject
    {
        [Required]
        public User User { get; set; }
        public string PasswordConfirmation { get; set; }

        public IEnumerable&lt;ValidationResult&gt; Validate(ValidationContext validationContext)
        {
            if(this.PasswordConfirmation != this.User.Password)
                return new[] { new ValidationResult(&quot;Passwords don&#39;t match&quot;, new[] { &quot;PasswordConfirmation &quot; }) };

            return new ValidationResult[0];
        }
    }

In this case the **server side validation works** but the **client side validation doesn&#39;t work** anymore. Implementing `IClientValidatable` seems a bit too complicated and I prefer not having client side validation in this case.

2. By inheritance
-----------------

    public class EditUserModel : User
    {
        [Compare(&quot;Password&quot;, ErrorMessage = &quot;Passwords don&#39;t match.&quot;)]
        public string PasswordConfirmation  { get; set; }
    }

When trying to directly save `EditUserModel` using EF it doesn&#39;t work, I get some some error message about the `EditUserModel` metadata so I&#39;m using *AutoMapper* to convert from `User` to `EditUserModel` and backwards.
This solution **works** but it more complex because I have to convert from the model to the view model and backwards.

3. By duplication
-----------------
*(Suggested by Malte Clasen)*

The view model would have all the properties of the model plus additional ones. *AutoMapper* can be used to convert from one to another.

    public class EditUserModel {    
      public string Name { get; set; }    
      public string Email { get; set; }    
      public string Password { get; set; }   
      [Compare(&quot;Password&quot;, ErrorMessage = &quot;Passwords don&#39;t match.&quot;)]     
      public string ConfirmPassword { get; set; }        
    }

This is the solution I like the least because of code duplication (DRY) 


**Questions**

What are the pros and cons of inheritance, composition and duplication in this case ?

Is there a simple way to have both client side and server side validation without having to convert the model to the view model and backwards ?

ASP.NET MVC Architecture : ViewModel by composition, inheritance or duplication?

This works, because it returns the result of partial view rendering in a string:

    @Html.Partial(&quot;Path/to/my/partial/view&quot;)

But I prefer to use `RenderPartial` and it seems I need to write:

    @{Html.RenderPartial(&quot;Path/to/my/partial/view&quot;);}

instead of:

    @Html.RenderPartial(&quot;Path/to/my/partial/view&quot;);

To get it to work. Error message:

     Compiler Error Message: CS1502: The best overloaded method match for &#39;System.Web.WebPages.WebPageExecutingBase.Write(System.Web.WebPages.HelperResult)&#39; has some invalid arguments

If there any better way instead of opening code block `@{...}` just for one method call?

Html.RenderPartial() syntax with Razor

Does anybody know how to enable gzip compression in MVC 3? I&#39;m using IIS7.

Google Chrome Audit&#39;s result:

&gt;  1. Enable gzip compression (4)   
&gt;  2. Compressing the following resources with gzip could reduce their transfer size by about two thirds (~92.23KB):  
&gt;  3. /mydomain/ could save ~1.53KB  
&gt;  4. jquery-1.4.4.min.js could save ~51.35KB 
&gt;  5. Cufon.js could save ~11.89KB  
&gt;  6. Futura.js could save ~27.46KB


How do I enable gzip compression when using MVC3 on IIS7?

I&#39;m new to MVC. I want to be able to hide some actionlinks for some users. Say I have a &quot;create&quot; actionlink which I only want administrators to see and click. I want to use some sort of &quot;loggedintemplate&quot; available in asp.net, but it doesn&#39;t seem to work in razor.

I could use some sort of code block with an if statement checking the current user and her role, however that may not be best practice?

my index.cshtml..

    // want some adminauth attribute here...
    @Html.ActionLink(&quot;Create New&quot;, &quot;Create&quot;)

my controller..

    // GET: /Speaker/Create
    [Authorize(Roles = &quot;Administrators&quot;)]
    public ActionResult Create()
    {
        return View();
    }


asp.net MVC3 razor: display actionlink based on user role

I was wondering if it&#39;s acceptable to put custom data in an HTTP authorization header. We&#39;re designing a RESTful API and we may need a way to specify a custom method of authorization. As an example, let&#39;s call it `FIRE-TOKEN` authentication.

Would something like this be valid and allowed according to the spec: `Authorization: FIRE-TOKEN 0PN5J17HBGZHT7JJ3X82:frJIUN8DYpKDtOLCwo//yllqDzg=`

The first part of the second string (before the &#39;:&#39;) is the API key, the second part is a hash of query string.

Custom HTTP Authorization Header

I need to authenticate a client when he sends a request to an API. The client has an API-token and I was thinking about using the standard `Authorization` header for sending the token to the server.

Normally this header is used for `Basic` and `Digest` authentication. But I don&#39;t know if I&#39;m allowed to customize the value of this header and use a custom authentication scheme, e.g:

    Authorization: Token 1af538baa9045a84c0e889f672baf83ff24

Would you recommend this or not? Or is there a better approach for sending the token?

Customize the Authorization HTTP header

I would like to block the access of some page even if the user knows the url of some pages.
For example, `/localhost:8080/user/home.xhtml` (need to do the login first) if not logged then redirect to `/index.xhtml`.

How do that in JSF ? I read in the Google that&#39;s needed a filter, but I don&#39;t know how to do that.


How implement a login filter in JSF?

I need to exclude one Url (or even better one prefix) from normal htaccess Basic Auth protection. Something like `/callbacks/myBank` or `/callbacks/.*`
Do you have any hints how to do it?

What I&#39;m not looking for is how to exclude a file. 
This has to be url (as this is solution based on PHP framework, and all urls are redirected with `mod_rewrite` to `index.php`). So there is no file under this URL. Nothing.

Some of those urls are just callbacks from other services (No IP is not known so I cannot exclude based on IP) and they cannot prompt for User / Password.

Current definition is as simple as:

```bash
AuthName &quot;Please login.&quot;
AuthGroupFile /dev/null
AuthType Basic
AuthUserFile /xxx/.htpasswd
require valid-user 
```

htaccess exclude one url from Basic Auth

I&#39;ve read about oAuth, Amazon REST API, HTTP Basic/Digest and so on but can&#39;t get it all into &quot;single piece&quot;. This is probably the closest situation - https://stackoverflow.com/questions/3963877/creating-an-api-for-mobile-applications-authentication-and-authorization

I would like to built API-centric website - service. So (in the beginning) I would have an API in center and **website** (PHP + MySQL) would connect via **cURL**, **Android** and **iPhone** via their network interfaces. So 3 main clients - 3 API keys. And any other developer could also develop via API interface and they would get their own API key. API actions would be accepted/rejected based on userLevel status, if I&#39;m an admin I can delete anything etc., all other can manipulate only their local (account) data.

First, authorization - should I use oAuth + xAuth or my some-kind-of-my-own implemenation (see http://docs.amazonwebservices.com/AmazonCloudFront/latest/DeveloperGuide/RESTAuthentication.html?r=9197)? As I understand, on **Amazon service user is == API user (have API key)**. On my service I need to separate standard users/account (the one who registered on the website) and Developer Accounts (who should have their API key).

So I would firstly need to **authorize the API key** and then **Authenticate the user** itself. If I use Amazon&#39;s scheme to check developer&#39;s API keys (authorize their app), which sheme should I use for user authentication?

I read about getting a token via `api.example.org/auth` after (via **HTTPS**, HTTP Basic) posting my username and password and then forward it on every following request. How manage tokens if I&#39;m logged in simultaneously on **Android** and a **website**? What about man-in-the-middle-attack if I&#39;m using SSL only on first request (when username and password are transmitted) and just HTTP on every other? Isn&#39;t that a problem in this  example https://stackoverflow.com/questions/8562223/password-protecting-a-rest-service

REST API Authorization &amp; Authentication (web + mobile)

I am writing an Authorize filter attribute adn I&#39;m having trouble figuring out how to get the current url as a string so I can pass it as a parameter to the LogOn action. The goal is that if a user successfully logs on, they will be redirected to the page they were originally trying to access.


    public override void OnAuthorization(AuthorizeContext filterContext)
    {
        base.OnAuthorization(filterContext);
        
        ... my auth code ...
        bool isAuth ;
        ... my auth code ...
        
        if(!isAuth)
        {
            filterContext.Result = new RedirectToRouteResult(
                new RouteValueDictionary { 
                    { &quot;Area&quot;, &quot;&quot; }, 
                    { &quot;Controller&quot;, &quot;Account&quot; }, 
                    { &quot;Action&quot;, &quot;LogOn&quot; },
                    { &quot;RedirectUrl&quot;, &quot;/Url/String/For/Currnt/Request&quot; } // how do I get this?
                }
            );
        }
    }

How do I get the full string Url from the current request?



How do I get the current Url from within a FilterAttribute?

I was looking to add an Action Filter to my service to handle adding link data to the response message.  I have found that I need to mock HttpActionExecutedContext but it&#39;s a difficult class to mock, how are you dealing with Action Filter testing?

How can you unit test an Action Filter in ASP.NET Web Api?

I&#39;m trying to implement what&#39;s seen here: http://www.piotrwalat.net/nhibernate-session-management-in-asp-net-web-api/ but I&#39;m having an issue with my `NhSessionManagementAttribute`.

I&#39;ve set breakpoints on my `OnActionExecuting(HttpActionContext actionContext)` to see whether the function was ever being called -- it wasn&#39;t.

I double-checked my `global.asax.cs` file &amp; found I am in fact registering the `ActionFilter` with: 

    GlobalConfiguration.Configuration.Filters.Add(new NhSessionManagementAttribute());

I have also decorated both my controller class itself, as well as its actions with the attribute to no avail:

    public class ClientsController : ApiController {
        static readonly ClientRepository repository = new ClientRepository();

        [NhSessionManagement]
        public IEnumerable&lt;Client&gt; GetAllClients() {
            return repository.GetAll();
        }
        
        [NhSessionManagement]
        public Client GetClient(int id) {
            Client client = repository.Get(id);
            if (client == null) {
                throw new HttpResponseException(
                    new HttpResponseMessage(HttpStatusCode.NotFound)
                );
            }
            return client;
        }
    }

Why would this action filter not be firing any of the events within?

Why is my ASP.NET Web API ActionFilterAttribute OnActionExecuting not firing?

I am using latest `web api`.

I do annotate *some* controllers with 3 different filter attributes.

    1 [Authorize]
    2 [RessourceOwnerAttribute derived from AuthorizationFilterAttribute]
    3 [InvalidModelStateAttribute derived from ActionFilterAttribute]

I can not be sure that the filters run in the order they are declared from top to down.

How do I define the order of execution in `web api 2.1` ?

https://aspnetwebstack.codeplex.com/workitem/1065#

http://aspnet.uservoice.com/forums/147201-asp-net-web-api/suggestions/3346720-execution-order-of-mvc4-webapi-action-filters

Do I still have to fix that for myself ??

Content Type	Original Author	Original Content on Stackoverflow
Question	Nick Olsen	View Question on Stackoverflow
Solution 1 - asp.net Mvc	BonyT	View Answer on Stackoverflow
Solution 2 - asp.net Mvc	Erik Funkenbusch	View Answer on Stackoverflow

Extend AuthorizeAttribute Override AuthorizeCore or OnAuthorization

asp.net Mvc Problem Overview

asp.net Mvc Solutions

Solution 1 - asp.net Mvc

Solution 2 - asp.net Mvc

Use sed to replace all backslashes with forward slashes

Are there any real life uses for the Java _signed_ byte primitive type?

Attributions