Authorize current user against controller and action name in ASP.NET MVC 3

Question

I need to create a customized authorization in ASP.NET MVC 3. Inside the app, authorization is defined in 5 tables: users, groups, usergroups, rights, grouprights. A user can belong to several groups, and each right can be assigned to several groups too. Each controller action is assigned a RightID.

The built in authorization can't accomodate this setup, so I tried to create a customized AuthorizeAttribute. When overriding AuthorizeCore, I realized I don't have access to controller name and action name.

Can I somehow ask the router to parse the Request.RawUrl inside AuthorizeCore to get controller and action name? Or is there another way to do what I want?

Darin Dimitrov · Accepted Answer · 2011-04-08 12:04:05Z

24

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    var routeData = httpContext.Request.RequestContext.RouteData;
    var controller = routeData.GetRequiredString("controller");
    var action = routeData.GetRequiredString("action");
    ...
}

answered Apr 8, 2011 at 12:04

Darin Dimitrov

1.0m276 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Endy Tjahjono Over a year ago

So I DO have access to controller and action name :)

Aliostad · Accepted Answer · 2011-04-08 12:02:32Z

0

You can achieve this using Action Filters where you have access to all HttpContex.

public class MyAuthorizeAttribute : ActionFilterAttribute, IAuthorizationFilter
{

    #region Implementation of IAuthorizationFilter

    public void OnAuthorization(AuthorizationContext filterContext)
    {
              // ... implementation

              // filterContext.Controller is the controller
              // filterContext.RouteData is all the route data

answered Apr 8, 2011 at 12:02

Aliostad

81.9k21 gold badges164 silver badges209 bronze badges

2 Comments

Endy Tjahjono Over a year ago

I read somewhere that I should not implement my own authorization filter because of some problem with output cache. Not sure whether this is still a problem in MVC 3.

thelem Over a year ago

OnAuthorization can be cached/shared across requests and users, so this is not secure. Use AuthorizeCore instead.

Collectives™ on Stack Overflow

Authorize current user against controller and action name in ASP.NET MVC 3

2 Answers 2

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related