dotnet-developer.de

or: How to create P3P (privacy policy) Files for IIS.

I have a facebook application which runs within the facebook frame. Everything works fine. I’m using Facebook C# SDK to authenticate the user. Then I store several information, e.g. users name and his facebook id, in session variables. Everything works fine but I betatester complained that he is not able to use the application. Checking his settings shows that he uses IE 9. That should not be the problem, just a side note: All others use Firefox and Chrome…. However, taking a closer look shows that his session cookies are lost! I could store them and immediately retrieve them, but if I want to access them in another part 2 seconds later they are gone. I’ve tried with my own IE 9 and it’s the same result: Session Cookies are lost. Firefox, Chrome and Opera work fine. So what’s the difference with IE? I have another app where each user has to authenticate with Facebook but there the app does not run within the facebook frame but in a seperate window, and there everything is working fine…

I found several different places with several small parts of explanations, e.g. Images without URL, and several solutions, e.g. add my site to the trusted sites in each IE, and after some articles I found the reason: The Platform for Privacy Preferences (P3P) Project. 

Wikipedia says: “The Platform for Privacy Preferences Project, or P3P, is a protocol allowing websites to declare their intended use of information they collect about browsing users. Designed to give users more control of their personal information when browsing, P3P was developed by the World Wide Web Consortium (W3C) and officially recommended on April 16, 2002.” So why does this disturb IE9 and not Firefox? And only within the facebook frame and not as standalone?

Read the rest of this entry

or: How to create P3P (privacy policy) Files for IIS. I have a facebook application which runs within the facebook frame. Everything works fine. I’m using Facebook C# SDK to authenticate the user. Then I store several information, e.g. users name and his facebook id, in session variables. Everything works fine but I betatester complained that he is not able to use the application. Checking his settings shows that he uses IE 9. That should not be the problem, just a side note: All others use Firefox and Chrome…. However, taking a closer look shows that his session cookies are lost! I could store them and immediately retrieve them, but if I want to access them in another part 2 seconds later they are gone. I’ve tried with my own IE 9 and it’s the same result: Session Cookies are lost. Firefox, Chrome and Opera work fine. So what’s the difference with IE? I have another app where each user has to authenticate with Facebook but there the app does not run within the facebook frame but in a seperate window, and there everything is working fine… I found several different places with several small parts of explanations, e.g. Images without URL, and several solutions, e.g. add my site to the trusted sites in each IE, and after some articles I found the reason: The Platform for Privacy Preferences (P3P) Project.  Wikipedia says: “The Platform for Privacy Preferences Project, or P3P, is a protocol allowing websites to declare their intended use of information they collect about browsing users. Designed to give users more control of their personal information when browsing, P3P was developed by the World Wide Web Consortium (W3C) and officially recommended on April 16, 2002.” So why does this disturb IE9 and not Firefox? And only within the facebook frame and not as standalone? P3P should make the privacy policy of each domain readable for machines, especially browsers. My page did not have such, probably like most other home-made sites. Most browsers don’t bother about missing privacy policy, but IE does. But only from third party. It’s also written in the Privacy tab of Internet explorer. Default privacy setting is ‘Medium’ which means Block third-party cookies that do not have a compact privacy policy Block third-party cookies that save information that can be used to contact you without your explicit consent So in my case my application is '”third-party” because it runs in the Facebook Frame at url http://apps.facebook.com . For you it’s easy to find out whether it’s the same case: In IE click ‘View’ –> ‘Webpage Privacy Policy’. If your domain is blocked than you probably need a privacy policy.  What is a privacy policy and how to get one? W3C defines P3P standards. As I’m probably not the first one searching for it I hoped to find a simple editor which creates such files for me and I’m done. Unfortunately it’s a bit more complicated There are some online services offering to create P3P files but before spending money I tried to find some free services. Surprisingly there are not too many, most websites recommend ‘P3P Policy Editor’ from IBMs Alphaworks. It could be downloaded from IBMs Download page. If you are using it for the first time it might be confusing (at least for me) so I’m happy to find section ‘An example’ on Content With Style. This helped me to create the necessary files. When you are done, save your files in all available options: ‘Save Policy as’… policy.xml ‘Save HTML as’ … privacy.html ‘Save Compact policy as’…. compact.txt Changes on IIS Configuration Now go to your servers IIS and change the HTTP Response Header for your site. Add a new element called ‘p3p’ and copy the text from compact.txt as value: Also create a new directory ‘w3c’ in your root directory. Before uploading the other files, a change has to be made to p3p.xml (example file below) according to this answer on ExpertsExchange: Policy-Ref has to be updated. When this is done, upload p3p.xml, privacy.xml and privacy.html to w3c-directory in your root. Use the P3P Validator from W3C to check whether all settings are correct. If not, take care about the advices from W3C and update your links or else. Live Test Now open your app again in IE. You should see that session cookies are now stored as expected. You could confirm this when you again check ‘View’ –> ‘Webpage Privacy Policy’: Your domain should not be blocked anymore! Example P3P.XML <META xmlns="http://www.w3.org/2002/01/P3Pv1"> <POLICY-REFERENCES> <POLICY-REF about="https://[your domain here].com/w3c/policy.xml#PrivacyPolicy"> <INCLUDE>/*</INCLUDE> <COOKIE-INCLUDE/> </POLICY-REF> </POLICY-REFERENCES> </META>

Playing around with jQuery and jTemplate and I had the following problem: On a page created with jTemplate I could not use asp:FileUpload Control. Additionally it would of course be better to have an Ajax / jQuery control as this would better integrate into a jQuery website. There are several jQuery Fileupload controls, and Ajax-Upload is my favorite, e.g. because it allows multiple fileupload and does not require Flash. Andrew Valums, the creator of the Ajax-Upload, has posted a C#-Example but as it’s just posted in the comments it might be missed easily. Additionally I needed it for Visual Basic so I’ve transfered it and wrote this short blog entry.

Read the rest of this entry

Playing around with jQuery and jTemplate and I had the following problem: On a page created with jTemplate I could not use asp:FileUpload Control. Additionally it would of course be better to have an Ajax / jQuery control as this would better integrate into a jQuery website. There are several jQuery Fileupload controls, and Ajax-Upload is my favorite, e.g. because it allows multiple fileupload and does not require Flash. Andrew Valums, the creator of the Ajax-Upload, has posted a C#-Example but as it’s just posted in the comments it might be missed easily. Additionally I needed it for Visual Basic so I’ve transfered it and wrote this short blog entry.First follow the instructions at Ajax-Upload page to setup your page. I use the following JavaScript-Code within my function 1 var uploader = new qq.FileUploader({ 2 element: document.getElementById('file-uploader'), 3 action: 'MyWebservice.asmx/ProcessFile', 4 debug: false, 5 sizeLimit: 1100000, // max size 1 MB 6 allowedExtensions: ['txt'] 7 });

For input validation I often use the Validators provided by Microsoft out of the box: RequiredFieldValidator to check whether user entered some data into the textbox, RangeValidator to check the range of numeric values or dates, RegularExpressionValidator to check the size of user input (and much more of course), CompareValidator to check dates, and today I had to use CustomValidator to check one field depending on another field.
My asp.net application contains a textbox which has to be filled if the user selected ‘Yes’ on a radiobutton. The RequiredFieldValidator does not help because you could not add a condition there. So it has to be done with the CustomValidator. I’ve searched around and finally combined several sources into this solution so here is a complete overview how to set up.

Read the rest of this entry

For input validation I often use the Validators provided by Microsoft out of the box: RequiredFieldValidator to check whether user entered some data into the textbox, RangeValidator to check the range of numeric values or dates, RegularExpressionValidator to check the size of user input (and much more of course), CompareValidator to check dates, and today I had to use CustomValidator to check one field depending on another field. My asp.net application contains a textbox which has to be filled if the user selected 'Yes' on a radiobutton. The RequiredFieldValidator does not help because you could not add a condition there. So it has to be done with the CustomValidator. I've searched around and finally combined several sources into this solution so here is a complete overview how to set up. Have a look at my RadioButton. Nothing special here. <asp:RadioButtonList ID="MyBtn" runat="server" RepeatDirection="Horizontal"> <asp:ListItem Value="Yes" /> <asp:ListItem Value="No" /> </asp:RadioButtonList></td> As I want to do the validation in the client we have to do some Javascript here. <script type="text/javascript"> function validateMyBtn(oSrc, args){ var rbtnValue = null; var rbtnList = document.getElementsByName('<%= MyBtn.ClientID %>'); var radio = rbtnList[0].getElementsByTagName("input"); for (var j = 0; j < radio.length; j++) { if (radio[j].checked) rbtnValue = radio[j].value; } if (rbtnValue == 'Yes') { args.IsValid = !(args.Value == "") } else { args.IsValid = true; } } </script> Take care about the property "ValidateEmptyText": If you miss this one, the validation is always "true" for empty fields.... Just to have it complete, here is the RequiredFieldValidator for the radiobutton: <asp:RequiredFieldValidator ID="MyBtnValidator" ControlToValidate="MyBtn" runat="server" ErrorMessage="Please make your choice" SetFocusOnError="true" />