ASP.NET MVC application - user authorization/permissions

Question

I have an ASP.NET MVC web application.

There's a welcome page in my application, and i wish for the user to complete some steps on that page before allowing him to use the application.

I'm trying to accomplish 2 things:

Ensure that the user is always redirected to that page until he completes the required steps. Note: the user is logged in when he is at the welcome page.
Ignore all requests made by that user to any of the controllers, except for a few specific requests to a specific controller.

What is the correct way to do the above?

Thanks.

Giannis Paraskevopoulos · Accepted Answer · 2013-10-01 07:17:28Z

1

What i have done is:

Create a class that derives from Controller and add the logic to redirect if not Logged in:

public class CustomController : Controller
{
    protected override void OnActionExecuting(ActionExecutingContext filterContext)
    {

        if (!LoggedIn) //Here you decide how to check if the user is Logged in
        {
            filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary(new
            {
                controller = "YourLogInControllerName",
                action = "YourLoginActionName"
            }));
        }
        else
        {
            base.OnActionExecuting(filterContext);
        }
    }
}

Then all Controllers derive from this CustomController class.

answered Oct 1, 2013 at 7:17

Giannis Paraskevopoulos

18.5k2 gold badges52 silver badges72 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

M Kenyon II Over a year ago

I think this is what I want to do for my project, but a few questions. What would be contained in filterContext? What if only some of my actions in a controller I want to be authenticated? (Maybe about and Contact Us don't need to be authorized?) Where can I get more info for this pattern?

Giannis Paraskevopoulos Over a year ago

filterContex is autopopulated by the application. string originAction = filterContext.RouteData.Values["action"].ToString(); could give you the action so you could check that.

CodeCaster · Accepted Answer · 2013-10-01 07:16:08Z

0

Sounds like you could use the session for that, or other (more persistent) storage if you must make sure the visitors finish these 'required steps', so you can store it when they've fininshed them.

answered Oct 1, 2013 at 7:16

CodeCaster

153k24 gold badges237 silver badges287 bronze badges

Comments

webnoob · Accepted Answer · 2013-10-01 07:20:41Z

0

I created a custom authorise attribute that redirected the use to my login page if they didn't meet the criteria I set. This then allowed me to use [AuthorizeAdminArea] on my base controller which stopped access to all areas. I then used [AllowAnonymous] to allow access to the login area.

Take a look at the SimpleMemshipProvider

answered Oct 1, 2013 at 7:20

webnoob

16k13 gold badges87 silver badges169 bronze badges

Comments

SilverlightFox · Accepted Answer · 2013-10-01 10:31:18Z

0

Use a Role and only allow access to the other controllers if the user has this Role. Add the user to this Role when they have completed the necessary steps.

See http://msdn.microsoft.com/en-us/library/9ab2fxh0.aspx

answered Oct 1, 2013 at 10:31

SilverlightFox

33.8k12 gold badges85 silver badges154 bronze badges

Collectives™ on Stack Overflow

ASP.NET MVC application - user authorization/permissions

4 Answers 4

2 Comments

Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

2 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related