The Issue

From the AngularJS documentation

A JSON vulnerability allows third party website to turn your JSON resource URL into JSONP request under some conditions. To counter this your server can prefix all JSON requests with following string “)]}‘,\n”. Angular will automatically strip the prefix before processing it as JSON.

Phil Haack outlines the issue here.

Can we automatically prepend ")]}',\n" in Web Api? Sure!

v2.0.2

I’ve finally got to updating my fork of Adam Shaw’s v2.0.2 Full Calendar.

There are a few changes required if you are going to move from the previous 1.6 version, namely the use of the moment.js date library. I’ve used this library previously and you owe it to yourself to take a look. It takes all that javascript date pain away. And that’s a good thing…

Self-post for me as I have already had to re-learn this 3 times now…

Company firewalls and policies can prevent npm and bower installing correctly.

Having recently started using OWIN to handle authorization, I’ve had to change a few things throughout my web api projects. To have the user’s identity available, I usually create something like:

I’ve previously posted on my “addition of resources” fork of the fullcalendar javascript control here. Today I want to outline some features around the drag/drop and click events that are a little undiscoverable.

Select

To add a select event callback, use the following config setting:

1
2
3
4
5
6
7
8

....
selectable: true,
select: function(start, end, allDay, ev) {
    console.log(start);
    console.log(end);
    console.log(ev.data);
},
....

There are a few different ways to pretty print objects as html in C#. We have a requirement to pretty print what might be XML or Json. The following extension method does the trick:

This little one caught me out for an hour or two. Moving away from the global ‘app’ variable in angularJs, I started using the angular.module syntax:

1

angular.module('UserHandler', [])

I got caught on this one last week. I was load testing a web api resource using ApacheBench and was getting some really bad perf figures in the region of 40 req/sec when I would have expected an order of magnitude more at least. The data model being sent as JSON was:

We have a requirement to have a dot midway in a route for one of our web api services. The route looks something like http://localhost/api/some.route/person. The controller (if using attribute based routing) is:

1
2
3
4
5
6
7
8
9

[RoutePrefix("api/some.route")]
public class UsersController : ApiController
{
  [Route("person")]
  public HttpResponseMessage Person(int id)
  {
    // do stuff
  }
}

So we have XSRF built into our app and all is well. Now we set the slidingExpiration=“true” in our web.config file:

1
2
3

<authentication mode="Forms">
  <forms loginUrl="~/Account/Login" timeout="2880" slidingExpiration="true" />
</authentication>