In the ASP.NET security model, the documentation goes out of its way to talk about the difference between Authorization and Authentication.

Unfortunately, the framework itself makes no such distinction. It treats an unauthenticated user access the same as a user who does not have authorization and returns the same error.

I realize this is probably a result of the fact that most web servers treat file access errors as 403's, because HTTP doesn't really give you any other status code, and you want to differentiate between server oriented 403's and framework generated 403's, but there must be a better way of dealing with this.

I suggest that the framework should not respond with a 401 if the user is authenticated, but rather a 403.something code maybe.

Currently in order to add asp.net mvc to an existing asp.net webforms project is not exactly pain free. Here's an example

http://www.devcurry.com/2013/05/adopting-aspnet-mvc-enhancements-in.html which actually includes having to add in some guid. Obviously lots of people have existing web forms sites/applications that are not going anywhere but would also like to integrate mvc into them as well. Currently, I would not call this user experience pleasant. I would be nice to be able to easily add mvc to an existing web forms site. It could be a NuGet package, a right-click on the web form site that has "add mvc to this"

I would like to explain the motivation for the idea first, then save the actual idea for last.
I made two observations which lead me to this idea. First, I noticed how much developers, where I have worked, are disappointed when a website hotfix requires a .Net code change. Whereas with procs, they are delighted because of how easy it is to modify the small unit of code and deploy. Second, I noticed that many IT managers and code-savvy end users are comfortable with making complex queries in SQL, or doing a complex formula in Excel, but when it comes to writing even a simple line of C#, they draw a firm line there. They don't even entertain the thought.

So I gave this some thought. How is it that such a powerful and clean language as C# is not often preferred over old SQL or painful Excel formulas?
I realized the problem is not with the language. It's not that C# is too hard. SQL cursors are actually more complex that C# loops. It is the packaging of it. The code merging, the solution compiling, the references, the build server, the deployment package, the versioning etc.

Consider that with SQL Server, I can, on a whim, open up Management Studio and...
within 2 minutes, I can write a query to (maybe not the best example...) update all customer purchase data and update the "total" column to equal the amount + tax.
within 3 minutes I can also save this as proc which instantly makes it accessible to other users of the system.
within 4 minutes I can also turn this into a scheduled job to run every night.

I could do this easily in any shop that uses SQL Server. But I couldn't possibly do anything like this with asp.net even in the most well run .net shop. I’m not suggesting that developers should be making quick snappy changes directly in production. What I’m suggesting is that technology platform should not prevent me from doing so. We enjoy these privileges with SQL, why not C#.

Let me paint a picture of what my suggestion might look like:
Step 1- Open the client. A UI similar to IIS.
Step 2- Right click on the web server node, pick “new WebService”, call it "ProductWS", put it on port 80.
Step 3- Right click on the Web Service node, pick “new Method”, call it "GetProductPrices".
Step 4- Start typing out a method.
Step 5- Run it right in the IDE (like how you run scripts in Management Studio). It would run in isolation, much like a unit test method would run. If the results are good, hit Save.
Step 6- Right click on web server node, pick “new job”, set schedule to run this method every day at 8pm.

Now anyone can access this code externally at http://codehost/ProductWS/GetProductPrices
Or access it within the server by simply calling GetProductPrices. All class structures, 3rd party dlls and service references would also reside on this hosting platform. Almost like a local GAC.
I think this idea would lend itself well for hosting web services and scheduled tasks/jobs. I don’t think it would necessarily be good for hosting UI.

While, when building an SQL statement, within a Web Pages .vbhtml module, I can write -

HWB_Series_Books_sqlCommand = "SELECT * FROM Titles WHERE Titles.Available_in_Series_" & Req_Series & " = 1"

where Req_Series is a variable containing, in my case, a capital letter in the range A to P, thus creating a dynamic reference to one of 16 fields, all of whose names begin with the same first 20 letters.

OR

in the case of Form Controls I could write something like

Dim LabelName = "Label 1"
Me.Controls(LabelName).Text = "Publisher"

thus being able to dynamically change the label whose text is being changed.

I find, to quote from a thread elsewhere, "There are not dynamic variable names in .NET (like PHP or other scripting languages)."

Having now set the scene I will make my suggestion / request, but just for clarification of the following, I include here the pair of interacting statements, which I have used to create Title_Details_Data.

Dim HWB_Title_Details_sqlCommand = "SELECT * FROM Titles WHERE Titles.Book_No = @0"

Dim Title_Details_Data = HWB_Database.QuerySingle(HWB_Title_Details_sqlCommand, Req_Title)

I find that I cannot write, in an IF statement, for example, which is referring to the values retrieved from a database, where there are many similarly named fields -

If "Title_Details_Data.Available_in_Series_" & Req_Series = 1 Then
[code to be executed]
End If

I wonder whether something like one of the two following options could be provided in VB, please?

Either -

1. A function that might be invoked with code something like -
ValuetoTest = VarValue("Title_Details_Data.Available_in_Series_" & Req_Series)

which would then lead on to IF ValuetoTest = 1 Then ...

OR

2. A property invokation accessing the returned database record could be provided, so that coding similar to the above regarding forms controls could then be used, such as maybe

If Title_Details_Data.Value("Available_in_Series_" & Req_Series) = 1 Then ...

As noted above in the quote from elsewhere I understand that something like what I want may be available in something like PHP, but I like VB and am happy using it. I have been using various varieties of BASIC since I first learnt the rudimentary BASIC, back in 1975, and so prefer to stay with what I know. Along the way I have also been a PL/1, IBM Assembler and dBase/Recital programmer.

Please consider my suggestion and, if you feel able, give me some feedback as to what you think of it.

Regards

Philip, Gosnells, Western Australia

Using html helpers can get pretty frustrating because of the overloads, ordering of parameters, etc.. Creating them is more frustrating when you try to follow these conventions. It would be useful if you migrated towards defined settings classes similar to how things are typically done in javascript:

@Html.EditorFor(
new EditorForOptions {
Expression = x => x.Field,
TemplateName = "Test",
AdditionalViewData = new { ... },
HtmlFieldName = "field",
AdditionalViewData = new { ... }
}
);

or

@Html.EditorFor(
x => x.Field,
new EditorForOptions {
TemplateName = "Test",
...
AdditionalViewData = new { ... }
}
);

It eliminates the need for redundant overloads, is easier to read, has a better intellisense story, and can open up some useful scenarios around options class factories.