Unable to Start Debugging on the Web Server

One of the error you'll probably run into when setting up a new ASP.net project is the "Unable to Start Debugging on the Web Server". Most of the time, this error can be fixed by enabling Integrated Windows Authentication. You can do this by:

1. Launch IIS Management Console.
2. Right click on the website and select Properties.
3. Click on the Directory Security Tab.
4. Check the box that reads "Integrated Windows authentication".

If that doesn't work, you'll need to make sure that Keep HTTP-Alives Enabled option is checked. And if all fails, register the .net framework again and check your permission settings.

Good Luck!

Troubleshooting ASP.net Application with CustomErrors

There are many ways to troubleshoot IIS application errors. Here I will discuss a simple yet effective way to troubleshoot your IIS applications.

In the Web.config, under System.web node, there's one section called customErrors. By default this is commented out and the mode set to

<system.web>
<customerrors mode="RemoteOnly">
<system.web>

With this setting in place, if you run into some error, chances are you will only see a generic runtime error that reads:

An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed remotely (for security reasons). It could, however, be viewed by browsers running on the local server machine.

In order to see what's going on, you will need to modify the Web.config file so the customErrors tag read:

<system.web>
<customerrors mode="Off">
<system.web>

Note that this should only be done on development workstations as the detailed error message could expose information you don't want users to see like identity impersonation information... As for production, try to run the application on the server to see the error.

Now that you can see what's actually causing the error, it should be easy to narrow the problem to a particular line number and take corrective action.

Fixing Fail To Access IIS Metabase Error

I often run into this error message for various reasons like doing a reinstallation, machine upgrade or preparing a workstation for a new co-worker...

This error is fairly simple to fix but if you don't know how, it could drive one crazy. You often run into this error after you install Visual Studio 2005 and then try to run a webpage on your machine. The error you encounter will read something like this:

Failed to access IIS metabase.

If so, you may have installed IIS after the .NET framework has been installed. To fix this, try to repair your ASP.NET installation and set up all of the appropriate ISAPI extension mappings using the aspnet_regiss utility in the .NET framework folder.

aspnet_regiis -i

This utility is found in the .NET framework version number under your Windows installation folder.

Web Application Security

Web applications are at great risks due to the fact that most applications are widely available to anyone with internet access. They often get compromised by script exploits.

Most script exploits require the application to accept malicious input and inject it into a page where it will be executed on the server or in the client browser. The potential damage from such an exploit depends on the script that is being executed (taking over a system, install malware, deleting data...)

The primary defense against script exploit is to never trust the information obtained from users. This apply to both incoming and outgoing data from users (data written to and data pulled from database).

There are many things a developer can do to protect application against script exploits. Data input by users should always be validated. Form elements should be HTML-encoded. Dynamic SQL might be flexible but yet it can compromise your data. Consider parameterized query against SQL queries using string concatenation.

In this simple example:

"Select * From Customers where LastName = " & txtLastName.Value

A malicious user who knows a something about database could turn that SQL statement into:

Select * From Customers Where LastName = 'a'; Delete From Customers Where LastName > ''

And when it gets executed, the database is compromised.

It is very important to understand how users and their data interact with your application. That way you can better protect your data, application and users from script exploits.
For more information on how to protect your web application see Basic Security Practices for Web Applications.

Cisco TFTP - Flash Update Problem

I was upgrading the IOS for the Cisco 6509s. I got Cisco TFTP Server setup and connected to it to download the file. The file was around 80Mb. TFTP Server threw an exception and shutdown. Upon restart, the file started to get downloaded but a few seconds later Cisco TFTP Server threw another error. This time I was able to view the error message and it said the transfer failed due to Synchronization Error.

I switched to SolarWinds TFTP Server and got a more detailed error saying the file was too large to be transferred through TFTP.

As an alternative, I used FTP Server from 3CDaemon and issued the command:

copy FTP: Disk0:

and it worked like a champ.

I had IIS running on my laptop so I turned off 3CDaemon and used IIS's FTP server. It worked out just fine.

So if you are transferring a large file you should use FTP and not TFTP to avoid potential problems and I also recommend 3CDaemon as it's got TFTP Server, FTP Server, Syslog as well as TFTP client all in one package.

Optimize Your Website For Performance

Performance can affect the number of visitors come to your site. The faster the site load, the better experience the visitors will get and the chances of them coming back will also be higher.

Network latency, congestion, packet drops... are already reducing your application performance. If you, the developer, can do anything to speed up content delivery, by all means, you should do it.

Unfortunately, most developers often neglect to pay attention to this are since it's not something they can really visually see and fix because there is no error that will popup and say "Hey, I am slow... fix me..." or something like that.

Here are a few tips that any developer can use to help speed up their web pages:

Put CSS code at the top of the page: if you put CSS at the top of the page, the browser will read it first. When the browser renders a web page, it doesn't have to search up and down looking for the style rules.

Move JavaScript code down to the bottom of the page: JavaScript’s are mostly run on the client side AFTER the page has been rendered. Moving them to the bottom of the page will allow the browser to render other markup tags first and present the UI to the client faster.

Compress java scripts & remove white space: The browser doesn't care if you name your function with a single character nor does it care if the name is 50 characters as long as they are valid. White spaces might make your code look good but will not help when it comes to speed. The less data your server has to spit out the faster your page will be delivered over the wire.

Remove duplicate and/or unused scripts: If it's not being used, remove it. If anything, it will cause more load on your network and create more confusion having it there when it comes time to troubleshoot some problems.

Do not mix Javascripts and HTML markups: Sometimes, you will need to use Javascripts to produce HTML markups. But try to reduce this to a minimum and let the browser finish one thing before it starts the next one (ie: complete HTML render before executing javascript...)

Move CSS & Javascripts out of HTML markups: Don't make the browser go back and forth between HTML markups and javascripts when it renders the page as there is a performance cost to this.

Add expires header: The browser save the pages onto the hard disk so that it can load the same site faster next time around. If there isn't a need for this, add expires header to it doesn't write the pages to disk.

Disable viewstates: ASP.net pages have viewstate enabled by default which adds a bunch of encrypted code to the page. If viewstate is not required, disable it and it will improve the page performance.

These tips will not significantly improve the performance of your web site as that will also depend upon how you compose your application but it will definitely improve the delivery of the page to the visitors. This is especially true if you have high traffic on your site.

If you get the opportunity, you should examine the HTML output for well known sites like Yahoo or Google and see how they optimize their site for performance. Chances are you will see these tips in action.

ViewState and Postback

I see a lot of people having problem preserving the controls's state when they perform postback. Most of these due to the fact they that don't quite understand how the form is processed on postback as seen in the following questions:

http://www.vbdotnetforums.com/showthread.php?t=18985
http://www.vbdotnetforums.com/showthread.php?t=19534

Have a look at this code snippet:

Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load

If Not IsPostBack Then

....

End If

LoadComboBoxes()

End Sub

IsPostBack will yield a True value if the page was posted back. You can use this to see whether this is the page load or refresh versus a post back and take appropriate action.

Let's say in the method LoadComboBoxes() you query the data from SQL and load that into the combo boxes. If you don't check for postback using IsPostBack, one of two things will happen:

1. If data binding is used on the controls or the Clear() method is called, all the state information gets wiped out and the controls will not retain their values.

2. If the Clear() method is not called then the combo boxes might have duplicate items added everytime you do a post back.

The recommended way for doing this is to move LoadComboBoxes inside the If statement that way it gets called once and also preserves postback data.

Access IIS application from computers on the same network

A user was having problem accessing his website on the network. The site is working fine from the local machine. However, when he tries to access the same site from a computer on the network, it's not working.

The problem and attempted answers can be viewed in this post. You should read the posts in that forum before continuing on this blog so things would make sense when you read the paragraphs below.

Let's logically work through the posts and try to sort out the problems:

1. Setting up a new website, IP address and port number is not necessary as the original site already working on the machine IIS is running from. Since all the computers are on the same network, you should be able to access it by computer name as well.

2. On Win XP, you can actually host more than one sites and running more than one IP on the same computer. But this won't be discussed in this blog. On top of that, it's not even relevant to the problem we are trying to solve.

3. This shouldn't be security issue also since IIS applications typically run on anonymous account by default and permission is granted when the site is set up; unless you specifically make change to it.

The true answer to this lies in Windows XP Pro SP2's built-in Firewall. Open port 80 in Windows Firewall to allow web traffic should solve this issue. If there are other software firewall running, check and open port 80 as well.

Brian Dao

Failed to access IIS metabase

I got a new laptop recently and tried to setup IIS and transfer existing sites to it. The laptop had typical Windows XP Pro setup with IIS 5.1, Visual Web Developer 2005 Express Edition and Microsoft .NET Framework 2.0 installed.

The sites were copied over and set to use ASP.NET version 2.0.50707 but when launched IIS generated the "Failed to access IIS metabase" error. Poking around on the internet I found some articles referring to things like granting permission to specific user accounts and re-registering ASP.NET... but none of these worked.

I even tried setting up a brand new website and still got the same problem. The only thing that worked was running the web apps as File System but that's not how I want it done.

While poking around with installed components (in Add/Remove Programs) and IIS settings, I suspected that the Microsoft .NET Framework 2.0 got corrupted so I reinstalled it.

Once the framework got repaired, all websites functioned the way they were supposed to. Hope this tip will help you solve problem.

Brian