Page #40 (Chapter 5 - Securing an IIS Application)

	Chapter 5 - Securing an IIS Application
	Visual Basic Developers Guide to ASP and IIS
	A. Russell Jones

Copyright 1999 SYBEX Inc.

---

	Create the Project

	First, start VB. You will see the New Project dialog. If VB is already running, select New Project from the File menu. Select the IIS Application project type as shown in Figure 5.2.

	Figure 5.2: Visual Basic New Project dialog

	Visual Basic will automatically create a new project containing a single WebClass Designer named WebClass1. As usual, the first thing to do is to rename the project and the default items so that you'll be able to differentiate between them

	later. Right-click the project name, select Properties, and rename the project SecuredSite. Double-click WebClass1 and rename it Signon. Select the NameInURL property and rename it Signon as well. Your screen should now look similar to Figure 5.3.

	Table 5.1 shows the list of design-time properties available in the Property Editor.

	Table 5.1: WebClass Design-Time Properties

	Property

Description

	Name

The class name of this WebClass object. Use this name to refer to the object within the project. The name you select is also the class name that appears in the Registry.

	NameInURL

Controls the name given to the ASP page to start the WebClass. For example, if you assign the name Signon to the NameInURL property, VB will name the ASP page Signon.asp.

	Public

Determines whether other programs can use methods and properties of this WebClass.

	StateManagement

There are two options:

wcNoState  This is the default value, and the one you should usually use. With no state management, the server will create a new instance of your WebClass for each page request and destroy it when the request has finished processing.

wcRetainInstance  You should not use this except on sites with small numbers of users. With wcRetainInstance set to True, the server will create a new instance of your WebClass for the first page request by a user, then store a reference to the WebClass object in a Session variable.

	Warning		The wcRetainInstance setting is so convenient that it is tempting to set it to True for every WebClass. Unfortunately, it also means that the server must then use the same thread on which it created the WebClass object for all subsequent requests by that user. This setting reduces the problems associated with maintaining state but severely reduces the scalability of your site. Don't use it unless you're sure the site will never have many visitors. That said, at times it's perfectly acceptable to keep a WebClass instance alive. If you're creating a site that will run on a stand-alone computer—for example, an application for mobile sales users who may not always be connected—then you don't have to worry about scalability. In such cases, you can take advantage of the persistent WebClass object to improve your development time and improve the application's response time. Without the overhead involved in creating the WebClass object and retrieving state information for the user's page request, the application's response time will improve.

	Save the project in a directory called SecuredSite. Using Windows Explorer, create two subdirectories of the project directory, one called images and one called HTMLTemplates. Figure 5.4 shows the project directory on my computer at this stage.