What's the appropriate way to deploy an ASP.NET application to production?

Question

I hate to sound stupid, but ASP.NET is not my forte.

I have build an ASP.NET application which I now which to deploy to a production server. Searching on the web I found that it's recommended to just use the Setup tool within VS2010 to compile and install the files on the production servers. However, I find it a bit weird:

1. The files on the server are exactly those that I had on my system. I would've imagined that moving to a production server would involve some compiling and compression of file content so as to improve execution. But in practice all files on the server are exactly as they are on my local system -- I can even modify my .cs file on the servers and that works!! (Surprised ;-)).
2. Following from the above, all my code is readily available on the server for anyone to see. I am not sure if this is a problem... For example, could it end up a security risk (due to passwords within the files)?

Answer 1

Did you create a web site or a web application project in VS2010? If it's a web site, you'll want to convert it to a web application project. Web sites can be compiled on the fly, when the app is first requested. A web application project is pre-compiled, and none of the .cs files will be pushed out to your production server when you publish the project.

I know I can do the conversion by right clicking on my web projects and selecting "Convert to web application", but that menu item might be present because of ReSharper (5.1) or the PowerCommands for Visual Studio 2010 extension from Microsoft.

Also, check your .aspx files. Do you have a .aspx and a .aspx.cs only? Or is there also a .aspx.designer.cs file? The designer files will only be present for a web application project. If you don't see them, you have a web site, not a web application project.

Answer 2

You can do as you've done but I would not recommend it for the reasons you've mentioned. Plus your code is not actually compiled!.

The typical approach would be to compile the app, then take the /bin dll and push them up to the server. A basic site needs a web.config, a bin folder with your DLLs and any ASPX files which contain the markup, any static content like JS/CSS/Images etc.. In this instance the markup (aspx) can still be edited but the CS code is inside the DLL and no CS files are on the server.

You can also pre-compile the whole thing which will actually modify the ASPX files and you can find out more here: http://msdn.microsoft.com/en-us/library/ms227972.aspx

Visual Studio 2010 has a "Publish" feature under the Build menu which can push the site for you via FTP or Web Deploy but this is only useful for smaller projects.

For most things you will want to look into msbuild or nant to script the process and this can allow you to incorporate things like JSmin or JSLint into the build/deployment aswell.

Hope that helps. -fs

Answer 3

1. It depends on how you do publishing. http://weblogs.asp.net/owscott/archive/2009/06/06/visual-studio-2010-1-click-publishing.aspx. "Exactly the same" is not a problem. Your expectation on compiling and compression is "so abnormal". Why must they be executed to make you feel happy while what you just need is a simply deployment?

2. How to protect your code is obviously some extra work you should manually do, such as tuning NTFS permissions and so on. There is nothing so automatic.