An interesting rant on the lost of your session in a web app.

That is why in QuickelSoft CMS front end pings the server from time to time so that you never loose your session.

In the previous version of QuickelSoft CMS, a URL would look like:
http://myserver/default.asp?Folder=124&Content=45

It says: Display the folder with the ID 124 and the content with the ID 45 using the page default.asp

This kind of URL:

• cannot be easily memorized
• does not say anything about the content to be displayed.

I wanted to avoid that in QuickelSoft CMS for ASP.Net, and have URLs looking like: http://myserver/product/description
Then, the CMS should automatically map that request to an aspx like mytemplate.aspx and send this page the name of the folder and the name of the content item to display.

http://myserver/product/description would be the same as http://myserver/mytemplate.aspx?Folder=/product&Content=description

This is called URL rewriting and it is the process of intercepting an http request and redirecting it to a different resource.

Prerequisites for URL rewriting in QuickelSoft CMS: "Medium Trust"
QuickelSoft CMS is often used in shared hosting environments and a lot of web hosts do not allow you to modify the configuration of the server running your web site and will also ask you to run with the security policy "Medium trust".

There are various ways of writing a URL rewriter in ASP.Net:

• Write an ISAPI filter to intercept the request.
• Map an Application Extension to the aspnet DLL in the IIS configuration so that URLs like http://myserver/myfolder/mycontent.html will also be processed by ASP.Net
• Use the Applicatiion_BeginRequest method in global.asax
• Some solutions use a custom 404 "page not found" handler.
• Use an HTTP handler or an HTTP module.

For more information on these methods, you can view this article on MSDN. http://msdn2.microsoft.com/en-us/library/ms972974.aspx

After some tests, I decided to use an HTTP module because:

• The ISAPI and the Application Extension are not acceptable as they oblige you to modify the server configuration.
• The global.asax solution was not my preferred one because it could force someone to mix their own code with a call to the QuickelSoft CMS API.
• The 404 trick does not seem to be very efficient or scalable.
• An HTTP handler cannot be used in "Medium Trust" so I use the HTTP Module solution.

How the HTTP module works
A HTTP module is called for every ASPX request in you web site.

Use these lines to add the QuickelSoft CMS Http module to your web site:

<httpModules>
	<add type="QuickelSoft.CMS.API.HttpModule" name="QuickelSoftCMSHttpModule" />
</httpModules>

As my module is only called if the URL contains ".aspx", I had to have it in each URL.

I had the choice of putting the ".aspx" at the end of the url (for instance, http://mysite/myfolder/mycontent.aspx).
With this solution, I would have to look into the database for each request to be sure that the url points to a resource managed by the CMS and not a specific folder or page of the web site.

To avoid that database call, it is by far quicker to just check if the URL begins with a prefix. The httpmodule can then quickly decide if the CMS processes the request or not.

In this example, each request on the site http://www.quickelsoft.com which begins with "/home.aspx" will be processed by the CMS and mapped to a template.

So, http://www.quickelsoft.com/home.aspx/en/product is managed by the CMS.
But https://www.quickelsoft.com/shop/buy.aspx is not.
Every time the web site receives a request for "/shop/buy.aspx", a simple string comparison is enough to establish that the request does not begin with "home.aspx" and so the httpModule must immediately give control back to ASP.Net.

You can defined the prefix you want in the site configuration in the field "URL rewriting prefix".

Conclusion
The idea of this post comes from John Udell and his article on why "aspx" in a URL is considered harmful.
http://blog.jonudell.net/2008/01/17/aspx-considered-harmful/

His point is:

The technology that produces the name, never mind the version of that technology, is a variable that 
need not, and should not, be exposed. If links are pointing to foo.asp, and your upgraded blog 
engine produces foo.aspx, you broke those links.

I do not think exposing a technology is so harmful. If one day you have to switch to a new technology, you can always use a redirection to your new URL.
That is what I did to a customer who used a web site in Lotus Notes to redirect the URL containing ".nsf" (Notes database) to an ASPX page.

PS: In the near future, the ASP.Net MVC framework should solve this URL problem and will remove the need for a prefix.
http://weblogs.asp.net/scottgu/archive/2007/10/14/asp-net-mvc-framework.aspx

By default, when a content item name or a folder name contains spaces, these are replaced by a “+” in the URL generated by QuickelSoft CMS.

For instance, if the folder name is "For webmasters" and the content item name is "Understanding pagination in QuickelSoft CMS", then the generated URL will be:

http://www.quickelsoft.com/home.aspx/en/library/for+webmasters/Understanding+pagination+in+QuickelSoft+CMS.html

This character “+” is called a double escape sequence and is now by default rejected by IIS 7 in an URL.

See more information on the IIS Team blog:

https://blogs.iis.net/thomad/archive/2007/12/17/iis7-rejecting-urls-containing.aspx

If you want to run QuickelSoft CMS on a computer that is running IIS 7 (like Vista), you will have to modify your web.config file.

1. Locate the following directory: %windir%\System32\inetsrv\config

2. Open the applicationHost.config file and locate the following code:

 <section name="requestFiltering" overrideModeDefault="Deny" />

3. Set the value of overrideModeDefault as “Deny” if not already set.

 <section name="requestFiltering" overrideModeDefault="Allow"/>

4. Open you web.config file

5. Add the following code in your file in the “configuration” section:

<configuration>
 <system.webServer>
  <security>
   <requestFiltering allowDoubleEscaping="True"/>
  </security>
 </system.webServer>
</configuration>