Datasheet

The advantage of using App_Offline.htm over the <httpRuntime /> section though is twofold:
❑ It is trivial to automate usage of
App_Offline.htm. Because it is just a file, administrative batch
jobs or administrative tools do not need to write code to bring an ASP.NET application offline
and then back online. As long as your administrative tools for your production servers can copy
files, you can use the
App_Offline.htm technique.
❑ You have easy control over the content that is sent back to your website users. With
<httpRuntime />, the default content is generated by ASP.NET. In the case that your website
disables remote error information with
<customErrors />, you may have some control over
error content assuming that you configured a custom error page for 404 errors. However, even if
you use custom error pages, there is no way to distinguish between a 404 triggered by nonexis-
tent website content, versus the 404 that ASP.NET generates when the application is offline.
With
App_Offline.htm you can create content for display to your users knowing that the
information will be displayed only when the ASP.NET application has been taken offline.
Calling Application_Start in global.asax
Probably the most relevant startup activity for ASP.NET developers is the Application_Start event
that can be authored in
global.asax. Probably most developers that use Application_Start just
breeze through writing the necessary code without worrying about the security context of this event.
However, ASP.NET carefully manages the security context that is used to execute
Application_Start.
Because the Application_Start event is written with user code, and the trust level has been previ-
ously established for the application domain, any code in the
Application_Start event will be
restricted based on the ASP.NET trust policy that was loaded for the application. Because the application
domain initialization process also establishes a specific security identity, ASP.NET explicitly chooses an
identity prior to running any code in the
Application_Start event.
25
Initial Phases of a Web Request
The Origins of App_Offline.htm
If you are wondering where the idea for App_Offline.htm originated, the idea was
actually developed to handle a problem having nothing to do with security or website
operations. SQL Server 2005 Express ships with the various versions of Visual Studio
and includes a special mode of operation called user instancing. A side effect of user
instancing is that SQL Server will hold a lock on your MDF database files while an
ASP.NET application is accessing them. In production, of course, this isn’t a problem.
However, if you are developing against IIS using Visual Studio, and you frequently use
Alt+Tab to switch between the website and the development tool, you would quickly
run into problems trying to edit data in your database using Visual Studio. Hence the
idea for
App_Offline.htm.
Now when a developer attempts to edit data in the Visual Studio data designers, Visual
Studio will first drop an
App_Offline.htm file into the ASP.NET application’s direc-
tory root. This has the effect of shutting down the ASP.NET application which in turn
causes all outstanding ADO.NET connections to SQL Server Express 2005 to be released.
As a result of the released connections, SQL Server Express 2005 detaches the MDF files
thus making them available to be re-attached by the Visual Studio design time.
04_596985 ch01.qxp 12/14/05 7:46 PM Page 25