ASP.NET Authorization without built in functionality

Question

I am currently working on some online shop so far so good. The only worry is I don't want to use built-in authorization functions. I want to do something different, to use Global.asax file. To catch Request.RawUrl in Application_BeginRequest so in the moment request is sent and to check for a specific folder if it is requested and to redirect back to log in if it is not authorized. The reason why I don't want to use built-in is because of the database. I want my own custom made database because there is many things I have done that I want to have full control of it. Yes, I saw many tutorials as recommended here before. I have searched for this stuff for a few days already saw many tutorials on how to customize those built-in functionalities.

Maybe my question looks complicated but in the end, I will ask simply. Is it safe to intercept each request in Global.asax file? And is it good idea to use Application_BeginRequest or something else?

Thank you kindly, everyone.

Allen Chen · Accepted Answer · 2020-06-12 18:01:01Z

0

It basically depends on your system and business model, if your every request needs to be authorized, then implement the authorization logic in Application_BeginRequest may meet your need. But in practice, I wouldn't recommend you to take this action, because once you do this, if someday you have a feature that can be access without logging in, then you have to find out another way to break this rule. That means your system will lose flexibility.

I suggest using Authorization filter, you can inherit AuthorizeAttribute class, and override its methods with your customized authorization logic. For more details: Custom Authorization filter in ASP.NET MVC 5?

answered Jun 12, 2020 at 18:01

Allen Chen

2261 silver badge8 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Bojan Pavlovic Over a year ago

i forgot to mention i am using WebForms.

Bojan Pavlovic Over a year ago

Anyway flexibility is not a problem, all I am thinking is if it is safe to do it there

Bojan Pavlovic · Accepted Answer · 2020-06-12 18:29:09Z

0

btw here is a simple code that I use

 protected void Application_BeginRequest(object sender, EventArgs e)
    {

        HttpCookie cookie = Request.Cookies["es"];

        if (Request.RawUrl.Contains(@"/admin"))
        {
            if (cookie ==null)
            {
                Response.Redirect("~/login.aspx");

            }
            else
            {
                if (cookie["role"] != "admin")
                {


                    Request.Cookies.Remove("es");

                    Response.Redirect("~/login.aspx");

                }
            }


        }

    }

answered Jun 12, 2020 at 18:29

Bojan Pavlovic

31 bronze badge

Collectives™ on Stack Overflow

ASP.NET Authorization without built in functionality

2 Answers 2

2 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related