A client of mine has an ASP.net/Sql Server application. They want to release a desktop version of this application. Our first thought was to use WinForms and share as much code as possible in the business logic code libraries. Someone then raised the possibility of repackaging the existing ASP.net code into a desktop application, and including with the install some type of Client Web Server that could run the ASP.net code on the user's website. This would save hundreds, if not thousands of hours of coding time, as the modifications to the existing ASP.net site would be negligible compared with coding a WinForms desktop app from scratch.

It seems that in theory, Cassini could server as the web-server component for such a distributed application.

Has anyone done this before? Some of our main concerns are:

• Can this be done? Can the webserver be included as part of the installation of the asp.net files, with everything configured so that it will really work?
• Our target user-base includes many people who are not tech-savvy, and many companies (like banks) where the IT departments are very security conscious. Is this type of application something that will raise some alarms among some of these IT departments (who would allow regular desktop applications, but might be more hesitant about allowing people to install personal web servers).
• Assuming the answers to the previous questions are that it is feasible and it isnt something that would be blocked by your above-average IT department, I would appreciate any advice in terms of implementation, especially from people who have done this in the past.

It could be done, sure, but remember

• The Cassini sample is just that, a sample, and was not tested for security. That's stated clearly in the sample  EULA where you assume security testing for your code.
• The Cassini sample works by opening up a port on the local machine and responds to local requests.  Like any other port that is opened for listening it is vulnerable to DoS attacks.  The sample chooses a random port which will help thwart attacks.
• If your ASP.NET app consists of thousands of pages, then every page in the application must be deployed on each desktop.  This means all users will be able to see every line of code on every ASPX page.  This kinds of negates the whole idea of ASP.NET applications where you want the code to exist on the server, and serve the results of those compiled pages to the user. 

We are doing just this for an application that we deploy a .NET 2.0 app to IIS and standalone Cassini alike.  We also use Cassini as a sort of 'fat-client' by connecting to an enterprise database from it.  Our application deploy but one set of aspx pages that both environments run.  We purposefully have set the Cassini to not listen to external off-workstation requests.  Seems to work for us, our app has like 5 portal tabs and probably 40 aspx tables.  Inside of the ASP we implemented 3 security membership/authentication/authorization providers following .NET 2.0 standards.

 This application consists of a winforms wrapper that launches the server internally and talks to it.  For production, we do not start Cassini separately and then use IE or Mozilla to talk to it, however, that works too as far as we have  tested that config.
 

 

How do you set Cassini to not listen to external off-workstation requests?  Is there a configuration setting or do we have to recompile the source code with this change.

By default, Cassini will not accept requests from outside the local machine.  There is nothing to configure - it is controlled within the server code, but can be disabled.

Anyone know if this sample will run .Net 3.5 Web application? If not, does anyone know a replacement or an equivalent (preferably free as well).

Thanks,
Alex