面板中的DefaultButton属性。

它为特定面板设置默认按钮。

在内容页中为masterpage启用智能感知 我敢肯定这是一个鲜为人知的黑客

大多数情况下，当你想要使用母版页中的控件时，你必须使用findcontrol方法并从内容页中转换它们，MasterType指令将在visual studio中启用智能感知

只需在页面上再添加一条指令

<%@ MasterType VirtualPath="~/Masters/MyMainMasterPage.master" %>

如果您不想使用虚拟路径，则使用类名

<%@ MasterType TypeName="MyMainMasterPage" %>

点击这里获取全文

If you use web services instead WCF services, you can still use standard .Net membership to enforce authentication and login session behaviour on a set web services similarly to a how you would secure web site with membership forms authentication & without the need for a special session and/or soap headers implementations by simply calling System.Web.Security.FormsAuthentication.SetAuthCookie(userName, false) [after calling Membership.ValidateUser(userName, password) of course] to create cookie in the response as if the user has logged in via a web form. Then you can retrieve this authentication cookie with Response.Cookies[].Value and return it as a string to the user which can be used to authenticate the user in subsequent calls by re-creating the cookie in the Application_BeginRequest by extracting the cookie method call param from the Request.InputStream and re-creating the auth cookie before the membership authenticates the request this way the membership provider gets tricked and will know the request is authenticated and enforce all its rules.

将此cookie返回给用户的示例web方法签名如下: 字符串登录(用户名、密码)

后续web方法调用示例如下: 字符串DoSomething(字符串authcookie，字符串methodParam1,int methodParam2等，等)，你需要提取authcookie(这是从登录方法获得的值)参数从请求。InputStreamis

这也模拟了一个登录会话并调用FormsAuthentication。签出在web方法，如注销(authcookie)将 使用户需要再次登录。

我曾经开发过一个asp.net应用程序，它通过了一家领先的安全公司的安全审计，我学会了这个简单的技巧来防止一个不太为人所知但很重要的安全漏洞。

以下解释来自: http://www.guidanceshare.com/wiki/ASP.NET_2.0_Security_Guidelines_-_Parameter_Manipulation#Consider_Using_Page.ViewStateUserKey_to_Counter_One-Click_Attacks

考虑使用Page。ViewStateUserKey用于对抗一键式攻击。如果您对调用者进行身份验证并使用ViewState，请设置Page。Page_Init事件处理程序中的ViewStateUserKey属性，以防止一键式攻击。

void Page_Init (object sender, EventArgs e) {
  ViewStateUserKey = Session.SessionID;
}

将属性设置为您知道对每个用户都是唯一的值，例如会话ID、用户名或用户标识符。

A one-click attack occurs when an attacker creates a Web page (.htm or .aspx) that contains a hidden form field named __VIEWSTATE that is already filled with ViewState data. The ViewState can be generated from a page that the attacker had previously created, such as a shopping cart page with 100 items. The attacker lures an unsuspecting user into browsing to the page, and then the attacker causes the page to be sent to the server where the ViewState is valid. The server has no way of knowing that the ViewState originated from the attacker. ViewState validation and HMACs do not counter this attack because the ViewState is valid and the page is executed under the security context of the user.

通过设置ViewStateUserKey属性，当攻击者浏览到一个页面以创建ViewState时，该属性将初始化为攻击者的名字。当合法用户向服务器提交页面时，将使用攻击者的名称对页面进行初始化。结果，ViewState HMAC检查失败并生成异常。

throw new HttpException(404, "Article not found");

这将被ASP捕获。NET，它将返回customErrors页面。在最近的.NET每日小贴士中了解了这一点

ASP的一个鲜为人知和很少使用的特性。网络:

标签的映射

它很少被使用，因为只有在特定的情况下你才会需要它，但当你需要它的时候，它是如此方便。

一些关于这个小功能的文章:

ASP中的标签映射。网 在ASP中使用标签映射。NET 2.0

从上一篇文章来看:

Tag mapping allows you to swap compatible controls at compile time on every page in your web application. A useful example is if you have a stock ASP.NET control, such as a DropDownList, and you want to replace it with a customized control that is derived from DropDownList. This could be a control that has been customized to provide more optimized caching of lookup data. Instead of editing every web form and replacing the built in DropDownLists with your custom version, you can have ASP.NET in effect do it for you by modifying web.config:

<pages>
 <tagMapping>
   <clear />
   <add tagType="System.Web.UI.WebControls.DropDownList"
        mappedTagType="SmartDropDown"/>
  </tagMapping>
</pages>