在服务器上保留ASP .NET代码隐藏文件？

Question

I'm inheriting a web application and the previous programmer compiled all his code into a .dll. The .cs files are not present on the server.

Working on previous projects, I've always uploaded the .aspx file and the corresponding .cs file. It's never been a problem for me and I always thought it was standard procedure. Am I wrong or just paranoid?

Answer 1

Will,I think this is quite common to keep code precompiled into dll. Then the code is less exposed for potential security holes. This provides also many advantages, which include faster initial response time, error checking, source-code protection, and efficient deployment. This is particularly important in large sites where there are frequent changes in Web pages and code files.

Answer 2

Leaving source code as a part of the project isn't necessarily the best source code management process. There are tools for that.

Also, precompiling source code isn't out of the ordinary (this is a Web Application project rather than a Web Site project in Visual Studio), and has many benefits.

Note that this doesn't make you wrong or paranoid.

Answer 3

There are good reasons for both strategies you just have to figure out what is going to work best for you environment and for the application.

In some ways it is good to have it precompiled if you worry about someone accidently making a change on the server but not checking the change into source control. With non-precompiled if you don't have change control on your server it can be hard to figure out who "accidently" made a change and why without checking it in.

On the other side, if you don't precompile it can make deployment more straight forward.

Just do a little research behind both strategies and decide what is going to work best in your situation.

Answer 4

As Nader pointed out, in a Web Application you don't need the CS files at all. There is not a huge risk of the source files being served accidentally, as protecting these files is a core function of IIS request management. Still, it is generally good practice not to deploy them to a production web server.

In any case, source files should at the bare minimum always be backed up in a location that is not the web server and should be source controlled whenever possible. I have seen too many websites where the source files were lost and the site was useless as a result.

Answer 5

Like everyone above has said, compiling source code into DLLs is considered best practice.

If you'd like to see the code of the DLLs you've been left with, there's a handy (and free!) tool called Reflector (apologies if you've already got it)

http://www.red-gate.com/products/reflector/

Just load up the DLL and then disassemble to view the source.

Answer 6

Web Application Projects compile into .dlls and leave no source on the server.

Web Site Projects deploy all the source to the server.

It's a religious war as to which is best. Google will present you with many varied opinions, so I won't press my own opinions on you.