MVC Controller Access

Question

Our application is being migrated from WebForms to MVC. We have a different manner to handle with authorizations. A Database View is queried to verify an user authorization. This view returns, according to each user, all menu hierarchy. For example, if the User1 is trying to access a page named SecretList.aspx, a search is applied through the menu hierarchy (saved in HTTP Session after auth) to check the access authorization. If a menu item related with SecretList.aspx exists to that user, then the access is granted.

My question is, how to implement this approach in ASP.NET MVC 3?

I wouldn't like to put Attributes for each Controller Action and I've been read about Route Constraints and Custom Controller.

To Route Constraints, could I access the HTTP Session and retrieve my Menu Hierarchy for Authorization query?

To Custom Controller, which method should I consider overloading? Can I check authorization and redirect to another view, before Controller execute the complete Action code?

Any other better idea?

can you use the standard Role Provider or customize it? stackoverflow.com/questions/376655/… — kenny
– kenny, Commented Apr 25, 2012 at 2:20
I don't have access to Roles Data in my code. All roles and users relationships are inside the Database View. — Douglas H. M.
– Douglas H. M., Commented Apr 25, 2012 at 2:41
To grant permission, I query a View. For Example, select * from vw_UserMenuFunctionality where user = ID. Through this view, we create our Object and put it in HTTP Session after Login. This object is a hierarchy of menus the user has access. If the page to be accessed exists in the Object.MenuList<>, so the access is granted. All this is done to not allow direct access by the address. — Douglas H. M.
– Douglas H. M., Commented Apr 25, 2012 at 3:10

Betty · Accepted Answer · 2012-04-25 02:29:15Z

2

I would use a custom Action Filter that is added globally to all actions, it would work very similarly to the built in Authorize Attribute. The action filter is run after routes have resolved and the controller is created (so anything passed to the controller must be constructable by any user) it can then check if the user can execute the action or if another ActionResult should be returned instead.

I would highly recommend looking at the MVC source (or using a tool like ILSpy) to view the code for the Authorize Attribute.

You could use a custom route constraint, but that would effectively mean the route doesn't exist for the user rather than they're not allowed access.

answered Apr 25, 2012 at 2:29

Betty

9,1892 gold badges38 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Betty Over a year ago

yeah I know it's open source now, however you get a better browsing experience using ILSpy than you do from the web (go to definition, analysis usages etc)

WDRust · Accepted Answer · 2012-04-25 13:29:35Z

If you don't want to apply Attributes to your actions and keep access logic away from the Controllers and Actions definition, you can build a global action filter.

    public class MenuAccessAttribute : ActionFilterAttribute
    {
        public override void OnActionExecuting (ActionExecutingContext filterContext)
        {
            var requestRoute = filterContext.RouteData.Route;

            var currentUser = WebWorker.CurrentUser; // Or wathever is your thing to get the current user from session

            if (currentUser != null && !MenuAccessService.UserHasAccessToRoute(currentUser, requestRoute))
            {
                filterContext.Result = new RedirectToRouteResult("MenuAccessDenied");
            }

            base.OnActionExecuting(filterContext);
        }
    }

Or something along these lines.

then, in global.asax Application_Start

        GlobalFilters.Filters.Add(new MenuAccessAttribute());

But, if i were you, i'd spend some time adapting my access logic with asp.net mvc Roles, implementing a custom RoleProvider and decorating my controllers and actions with the right Authorize attributes.

Collectives™ on Stack Overflow

MVC Controller Access

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related