Question

We had a very strange issue on our servers this week, where a method in an aspx script (with no code-behind file) was somehow getting called from completely unrelated pages elsewhere on our site. Basically, the script said this:

   <script language="c#" runat="server">
   public void Page_Load(object sender, EventArgs e)
   {
        // some initializer logic
        PageMethod("data");
   }
   public string PageMethod (string strInput) 
   { 
        // More logic
   }
   </script>

We operate a farm of four servers, and we were seeing the PageMethod getting called by scripts in several places on all servers, so while my first instinct was that this was a corrupted cache on the server (and I still suspect it might be), my gut tells me that we were allowing this to happen with our code. We’ve been using this code style for yonks, but recently upgraded our servers to .NET 2.0.

My first question is, should a public method in an aspx every be accessible to a script elsewhere on a website? And my second question is, should we be using private or protected methods on aspx pages (I always figured the code in a stand-alone page was self contained, so sloppy access modifiers shouldn’t make a difference).

(Note: I don’t write much c#, so my grasp of the language is pretty much just theoretical. I’m just trying to troubleshoot this issue before it becomes a real issue.)

Answer 1

My first question is, should a public method in an aspx every be accessible to a script elsewhere on a website?

In order to invoke a public instance method, an instance of this class is required. I suspect that your issue is not related to other scripts calling this method directly. It’s more probable that there is an HTTP request being sent to the corresponding ASPX page which in turns invokes the method. This request could be done by the client (some link on a page, …) or directly by the server (using HttpWebRequest). To further debug the problem try looking at the web server log files to see all the requests being made to this page.

And my second question is, should we be using private or protected methods on aspx pages (I always figured the code in a stand-alone page was self contained, so sloppy access modifiers shouldn’t make a difference).

If those method are not intended to be used by other parts of the code it is a good practice to make them private or protected and that’s not only related to ASP.NET.