ASP.NET MVC Attribute to only let user edit his/her own content

Question

I have a controller method called Edit in which the user can edit data they had created like so ...

public ActionResult Edit(int id)
{
    Submission submission = unit.SubmissionRepository.GetByID(id);
    User user = unit.UserRepository.GetByUsername(User.Identity.Name);

    //Make sure the submission belongs to the user
    if (submission.UserID != user.UserID)
    {
        throw new SecurityException("Unauthorized access!");
    }

    //Carry out method
}

This method works fine however it is a little messy to put in every controller Edit method. Each table always has a UserID so I was wondering if there was an easier way to automate this via an [Authorize] Attribute or some other mechanism to make the code cleaner.

Darin Dimitrov · Accepted Answer · 2012-06-14 16:31:05Z

32

Yes, you could achieve that through a custom Authorize attribute:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var authorized = base.AuthorizeCore(httpContext);
        if (!authorized)
        {
            return false;
        }

        var rd = httpContext.Request.RequestContext.RouteData;

        var id = rd.Values["id"];
        var userName = httpContext.User.Identity.Name;

        Submission submission = unit.SubmissionRepository.GetByID(id);
        User user = unit.UserRepository.GetByUsername(userName);

        return submission.UserID == user.UserID;
    }
}

and then:

[MyAuthorize]
public ActionResult Edit(int id)
{
    // Carry out method
}

and let's suppose that you need to feed this submission instance that we fetched into the custom attribute as action parameter to avoid hitting the database once again you could do the following:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var authorized = base.AuthorizeCore(httpContext);
        if (!authorized)
        {
            return false;
        }

        var rd = httpContext.Request.RequestContext.RouteData;

        var id = rd.Values["id"];
        var userName = httpContext.User.Identity.Name;

        Submission submission = unit.SubmissionRepository.GetByID(id);
        User user = unit.UserRepository.GetByUsername(userName);

        rd.Values["model"] = submission;

        return submission.UserID == user.UserID;
    }
}

and then:

[MyAuthorize]
public ActionResult Edit(Submission model)
{
    // Carry out method
}

edited Jun 14, 2012 at 16:31

answered Jun 14, 2012 at 16:20

Darin Dimitrov

1.0m277 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Stefan Bossbaly Over a year ago

Thank you! I am going to make this more generic. Like have submission implement an interface called IUserOwnable which has a UserID. And then pass in the repository into the Attribute where it fetches an IUserOwnable and compared that UserID of the user to the UserID of the IUserOwnable

Darin Dimitrov Over a year ago

Sure, this could be made as generic as you like to suit your specific requirements.

Sagiv b.g Over a year ago

Nice approach. I was hopping that by now it will have a built in attribute for that

abiNerd Over a year ago

How would you cache this so that it doesn't need to check the db every time there is an authorizer attribute for this particular submission_id and user_id? @DarinDimitrov

Dawood Awan Over a year ago

@DarinDimitrov what is the best way to do this .net core, in a web API with JWT Token based authentication?

Bob The Janitor · Accepted Answer · 2012-06-14 16:44:10Z

2

I would suggest you pull the logic out of the action/controller and build a domain class to handle that logic.

Action methods should really only deal with getting data from and sending data to the view. You could create something generic enough to handle your needs but will also follow the single responsibility principal.

public class AuthorizedToEdit 
{
     protected override bool AuthorizeCore(string user, int itemId)
     {
         var userName = httpContext.User.Identity.Name;

         var authUsers = SubmissionRepository.GetAuthoriedUsers(itemId);

         return authUsers.Contains(user);
     }
}

This would also allow you to have the flexibility later on to allow something like admin users

answered Jun 14, 2012 at 16:44

Bob The Janitor

20.8k10 gold badges51 silver badges72 bronze badges

Comments

Isaac Zahn · Accepted Answer · 2019-03-30 11:33:39Z

0

@if (Request.IsAuthenticated && User.IsInRole("Student"))
    {
    @Html.ActionLink("Edit", "Edit", new { id = item.StdID })
    }

in my case, the loggedIn user is a student. so i say if the login request is authenticated, and if his role is student, then let the link for edit be accessible to him.

this below allows you to let the ordinary user OR the Admin perform edit also.

@if(Request.IsAuthenticated && User.IsInRole("Student") || 
User.IsInRole("Administrator"))
{
 @Html.ActionLink("Edit", "Edit", new { id = item.StdID })
}

answered Mar 30, 2019 at 11:33

Isaac Zahn

115 bronze badges

Comments

Community · Accepted Answer · 2017-05-23 12:10:44Z

-1

I recommend reading up on the AuthorizeAttribute (see here). Also, have you seen this post? It goes over how to override the authentication attribute innards and how to use IPrincipal and IIdentity.

edited May 23, 2017 at 12:10

CommunityBot

11 silver badge

answered Jun 14, 2012 at 16:22

Ross

2,4681 gold badge22 silver badges25 bronze badges

Collectives™ on Stack Overflow

ASP.NET MVC Attribute to only let user edit his/her own content

4 Answers 4

5 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

5 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related