Implementing Security - ASP.NET Dynamic Data - page 470

NOTE
Although the Insert hyperlink appears directly in the page markup and you could access
it through the page field generated by Visual Studio, you still want to use control's
OnInit event handler to set its visibility. The obvious first reason is consistency—it is
nice to have security trimming implemented the same way for all action links. However,
it is also important to use the OnInit event handler to initialize controls to prevent the
unnecessary ViewState bloat.
By setting control's Visible property to false , you remove it from the resulting HTML
that is sent to the user's web browser. With the DynamicHyperLink control, this means
that the <a href=”…” /> element is not generated. However, unless you set the
Visible property in the OnInit event handler of the control itself, the page stores its
value in the ViewState . Because the List page does not expect visibility of the Insert
links to change between post-backs of this page, this information will increase the
page size unnecessarily.
The same principle applies to other control properties as well. Setting them at any
point after control's own initialization ends, such as page's Init event or control's Load
event, results in property values being recorded in the ViewState . If you don't expect
control properties to change based on user actions, you can avoid the unnecessary
ViewState overhead by setting them in the control's Init event handler.
Figure 14.6 shows how the Products list page looks with the completed List page template
when the current user does not have permissions to update, insert, and delete Product
entities. If you compare it to the previous version shown back in Figure 14.4, you will
notice that it does not display the Edit and Delete links in the grid and the Insert link
under it.
FIGURE 14.6 Products List page hiding inaccessible actions.