Brad Wilson

Remote Validation with ASP.NET MVC 2

One validation feature that we didn’t quite have time for in MVC 2’s new client-side validation support is called “remote validation”.

Remote validation means we make a call back to our web site to ensure that a given value is valid. You might want this in cases where it’s not easy (or possible) to determine whether the value is valid on the client side, but you’d still like to give the user client-side feedback about the validity of the item. The canonical example is checking to see if a desired username is taken during your site registration process.

Input Validation vs. Model Validation in ASP.NET MVC

After extensive discussion among the team, we've decided to make a last-minute change to ASP.NET MVC 2 in regards to way that validation is handled. The conversation was kick-started by my blog post about the Required attribute and what it does (and does not) mean. More importantly, I want to re-address the security issues I brought up in the last post, now in the context of Model Validation, to understand whether this change makes your applications more secure.

To understand what we did, let's start with where we were a couple days ago.

[Required] Doesn’t Mean What You Think It Does

I removed this blog post, because it was re-written over here in the context of the new Model Validation feature.

The primary purpose of this original post — to highlight the security issues of under- and over-posting — is absolutely still valid. Model Validation does not absolve you from thinking about those issues. Go read that other post to understand why.

I have also closed the comments here, and encourage further comments to be made on the new blog post.

My Video Setup

Bertrand blogged his A/V setup and asked if I would do the same. Keeping with the theme of "semi-geeky", I thought I'd talk about the way everything is installed and wired.

Why You Don't Need ModelMetadata.Attributes

Hardly a week goes by where someone isn’t requesting that we add a .Attributes collection to ModelMetadata in MVC 2.

We don’t want to add this collection, because it gives attributes a “better among equals” status among all the ways that you could express metadata (in addition to attributes, you might choose to get your metadata from your database schema, from data inside a database, from an external configuration source like an XML file, among many other possibilities). If we add .Attributes, we’re declaring one way king – or leaving ourselves open to many other requests for everybody else’s favorite kind of system.

...Of The Decade

All throughout the day yesterday (before and after work), I was tweeting my own personal observation of best stuff of the decade. I collected them all here for your refutation. :)

Music Artist of the Decade: Opeth
Pop Album of the Decade: Discovery by Daft Punk
Rock Album of the Decade: In Absentia by Porcupine Tree
Metal Album of the Decade: Blackwater Park by Opeth

Author of the Decade: Neil Gaiman
Sci-Fi Book of the Decade: Chasm City by Alastair Reynolds
Fantasy Book of the Decade: A Storm of Swords by George R. R. Martin

Television Show of the Decade: Battlestar Galactica

Movie of the Decade: The Dark Knight

Comedian of the Decade: Patton Oswalt

Gadget of the Decade: iPhone

Board Game of the Decade: Puerto Rico
Video Game of the Decade: Half-Life 2