Add the XPO Middle Tier Server to an Existing WinForms Application (.NET)

• Jan 19, 2026
• 3 minutes to read

This topic contains step-by-step instructions on how to add a Middle Tier Security project to a WinForms application and use it as the Middle Tier Server.

A Middle Tier security project cannot be added separately; instead, create a new solution with Middle Tier security enabled, then copy and add the security project to your solution, and configure the application.

Add a Middle Tier Security Project

1. Use the DevExpress Template Kit or CLI template to create a new solution.
   Specify the same name, additional modules, and authentication settings as in your project. Select XPO ORM and activate the Middle Tier Security option.
2. Copy the MySolution\MySolution.MiddleTier folder from the newly created solution to your solution.
3. Add the MiddleTier project to your solution. Right-click the solution in the Solution Explorer, choose Add | Existing Project…, and select MySolution.MiddleTier\MySolution.MiddleTier.csproj.

4. Install the DevExpress.ExpressApp.Security.Xpo.Extensions.Win NuGet package to the MySolution.Win project.

5. The Security System requires ApplicationUser and ApplicationUserLoginInfo business objects to store user information. If the MySolution.Module project does not contain these objects, add ApplicationUser and ApplicationUserLoginInfo objects to the MySolution.Module project as described in the following topic: Use the Security System.

6. If your application is created with DevExpress v21.2 and below, add the following code to the MySolution.Win\Program.cs file:

   File: MySolution.Win\Program.cs

   C#

   using System.Net;
   using System.Net.Http.Headers;
   using System.Net.Http;
   using System.Net.Http.Json;
   using DevExpress.ExpressApp.Security.ClientServer;
   // ...
   namespace MySolution.Win {
       static class Program {
           static void Main() {
               // ...
               Tracing.Initialize();
               MySolutionWindowsFormsApplication winApplication = new MySolutionWindowsFormsApplication();
               var httpClient = new HttpClient();
               httpClient.BaseAddress = new Uri("https://localhost:44318/");
               var webApiSecuredClient = new WebApiSecuredDataServerClient(httpClient, winApplication.TypesInfo);
               // The `WebApiMiddleTierClientSecurity` constructor gained an additional parameter of the `IServiceProvider` type in v.22.2.5.
               // Refer to the following breaking change ticket for more information:
               // https://www.devexpress.com/scid=t1156798
               var security = new WebApiMiddleTierClientSecurity(webApiSecuredClient, null) { IsSupportChangePassword = true };
               winApplication.Security = security;
               winApplication.CreateCustomObjectSpaceProvider += (s, e) => {
                   e.ObjectSpaceProviders.Add(new MiddleTierServerObjectSpaceProvider(webApiSecuredClient));
               };
               //...
           }
       }
   }
   

7. If the MySolution.Win\Program.cs file contains the following autogenerated code, comment it out:

   File: MySolution.Win\Program.cs

   C#

   namespace MySolution.Win {
       static class Program {
           [STAThread]
           static void Main() {
               //...
               //winApplication.GetSecurityStrategy().RegisterXPOAdapterProviders();
               //...
   //#if DEBUG
   //              if(System.Diagnostics.Debugger.IsAttached && winApplication.CheckCompatibilityType == CheckCompatibilityType.DatabaseSchema) {
   //                  winApplication.DatabaseUpdateMode = DatabaseUpdateMode.UpdateDatabaseAlways;
   //              }
   //#endif
   

   If your application’s Startup.cs file has code that adds an XPO ObjectSpace provider to the application builder and adds integrated security, remove this code and add the code that initializes the Middle Tier security mode:

   C#

   // Remove or comment out this code:
   //builder.ObjectSpaceProviders
   //    .AddSecuredXpo((application, options) => {
   //        options.ConnectionString = connectionString;
   //    })
   //    .AddNonPersistent();
   //builder.Security
   //    .UseIntegratedMode(options => {
   //        options.RoleType = typeof(PermissionPolicyRole);
   //        options.UserType = typeof(YourSolutionName.Module.BusinessObjects.ApplicationUser);
   //        options.UserLoginInfoType = typeof(YourSolutionName.Module.BusinessObjects.ApplicationUserLoginInfo);
   //        options.UseXpoPermissionsCaching();
   //    })
   //    .UsePasswordAuthentication();
   
   // Add this code:
   builder.Security
   .UseMiddleTierMode(options => {
       options.BaseAddress = new Uri("https://localhost:5001/");
   }, securityModuleOptions => {
       securityModuleOptions.NonSecureActionsInitializing += (s, e) =>
           e.NonSecureActions.Add("Demo About Info");
   })
   .UsePasswordAuthentication();
   

8. Right-click the Solution node in the Solution Explorer and choose Properties. In the Solution Property Pages dialog, expand the Common Properties node and select Startup Project. Choose the Multiple Startup Projects option and select the Start action for the MySolution.MiddleTier and MySolution.Win projects.

   

   Run the application.