Hosting .NET Windows forms UserControl in IE

Hello,
I need to host .NET Windows forms UserControl in Internet Explorer. I do it
by including <OBJECT> tag in my aspx page:

<OBJECT id="mycontrol1" classid="MyControl.dll#MyControlNamespace.MyControl"
width=800 height=300 style="font-size:12;" VIEWASTEXT>
</OBJECT>

everything works fine, MyControl.dll gets downloaded into the download cache
and IE displays the control. The problem however is the fact that the browser
needs to download MyControl.dll file. Our clients will block downloads of
.DLL and .EXE files. I would like to use CAB file instead, for example, I
tried codebase attribute as in the following:

<OBJECT id="mycontrol1" codebase="MyControl.cab"
classid="MyControl.dll#MyControlNamespace.MyControl" width=800 height=300
style="font-size:12;" VIEWASTEXT>
</OBJECT>

but it does not work.
Is there a way of making IE to download a CAB file, just as it does for an
ActiveX components, and extract contents into the download cache, so that no
DLL file needs to be downloaded?
Thank you,
Slava.

v-jetan
Tue Dec 28 20:05:34 CST 2004

Hi Slava,

Thanks for your posting!

I think IE does not support hosting .cab file for winform control self
extract.

Can you tell me how your IE client disabled the downloading of exe and dll?
And, why the downloading must be disabled?

Actually, IE is a thin client, which has limited control and function on
client machine, while hosting winform control in IE is a way of
strengthening the function of this thin client. For security reason, this
strengthening must be trusted by the client user through client IE setting.
In another word, this strengthening have to be allowed. So the hosting
action is based on client trusting, and we can not break the client
trusting mechanism.

So we usually put a prompt message on the page to notice the client user to
open the least requested security setting.

Hope this makes sense to you.
========================================
Thank you for your patience and cooperation. If you have any questions or
concerns, please feel free to post it in the group. I am standing by to be
of assistance.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.

sva
Wed Dec 29 08:15:04 CST 2004

Hi Jeffrey,
Obviously our client can not block it on the firewall, because our web site
uses SSL. I was told they use some monitoring software installed locally on
the client machines to watch for what is being downloaded. They block EXE and
DLL, obviously for security reasons.
In order to download this DLL, the browser just issues a GET request. The
monitiring software does not know or care that it is a .NET assembly that
will be installed into download cache and ran in a sandbox, it only sees that
a DLL file is being downloaded, and it is prohibited.
I am surprised the CAB files are not supported, at the very least they are
supposed to be smaller in size, therefore faster to download.
I guess we will have to convince our client to open it up for our web site,
or maybe pre-install the control in question into GAC on their clien machines
- I guess it should work, although this option looks very unattractive for me
because of distribution/versioning issues.
Thank you for the help.




""Jeffrey Tan[MSFT]"" wrote:

> Hi Slava,
>
> Thanks for your posting!
>
> I think IE does not support hosting .cab file for winform control self
> extract.
>
> Can you tell me how your IE client disabled the downloading of exe and dll?
> And, why the downloading must be disabled?
>
> Actually, IE is a thin client, which has limited control and function on
> client machine, while hosting winform control in IE is a way of
> strengthening the function of this thin client. For security reason, this
> strengthening must be trusted by the client user through client IE setting.
> In another word, this strengthening have to be allowed. So the hosting
> action is based on client trusting, and we can not break the client
> trusting mechanism.
>
> So we usually put a prompt message on the page to notice the client user to
> open the least requested security setting.
>
> Hope this makes sense to you.
> ========================================
> Thank you for your patience and cooperation. If you have any questions or
> concerns, please feel free to post it in the group. I am standing by to be
> of assistance.
>
> Best regards,
> Jeffrey Tan
> Microsoft Online Partner Support
> Get Secure! - www.microsoft.com/security
> This posting is provided "as is" with no warranties and confers no rights.
>
>

v-jetan
Thu Dec 30 04:05:13 CST 2004

Hi,

Thanks very much for your feedback!

I am glad you got a workaround for this issue. Actually, .Net wanted to use
client's machine's Code Access Security setting to control hosting winform
control in IE, it does not rely on the monitor software, so currently,
Net1.1 does not support .cab file for winform control. That is, .Net hopes
we reply on CAS setting, not the monitor software at client machine.

Anyway, if you still have any concern on this issue, please feel free to
tell me, thanks.

Best regards,
Jeffrey Tan
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
This posting is provided "as is" with no warranties and confers no rights.