Implementing object-level security with attributes in ASP.NET MVC

Question

Is it possible to implement object-level security with a custom ActionFilterAttribute?

I read Branislav Abadjimarinov's answer to Get permission from Authorize Attribute? and started thinking about making an AuthorizeAttribute-like action filter for implementing object-level security.

Suppose I were to call it ObjectAuthorizeAttribute with the intended usage:

[ObjectAuthorize]
public ActionResult Edit(int id)
{
    //...

What would be the easiest way to access the ID value within OnActionExecuting?

Is something like this already available?

tvanfosson · Accepted Answer · 2011-01-23 16:30:53Z

2

You can extend the AuthorizeAttribute and have access to things like RouteData via the AuthorizationContext. If you are doing authorization I think it makes more sense to start from the AuthorizeAttribute rather than ActionFilterAttribute.

var id = filterContext.RouteData.Values["id"];

answered Jan 23, 2011 at 16:30

tvanfosson

534k102 gold badges703 silver badges801 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Daniel Trebbien Over a year ago

I was wrong. Even though Values is a dictionary from strings to objects, RouteData.Values["id"] is still a string in my case even though I specify int id in the method signature. Regardless, your mentioning the RouteData property was extremely helpful.

Darin Dimitrov · Accepted Answer · 2011-01-23 16:28:36Z

1

var id = filterContext.HttpContext.Request["id"];

answered Jan 23, 2011 at 16:28

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

1 Comment

Tom Clarkson Over a year ago

This will work for Edit?id=1 but not for Edit/1, which is usually the same page in MVC.

Collectives™ on Stack Overflow

Implementing object-level security with attributes in ASP.NET MVC

2 Answers 2

1 Comment

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related