Enforce security check in ASP.NET MVC?

Question

I am implementing a collaborative web gallery, and I have a few roles for each user:

Admin
DeleteImage
DeleteOwnImage
etc..

For any controller-action, we can apply [Authorize] tag to them plus which roles we want to allow, right? It is fine for Admin/DeleteImage since these two are global; but my question is, like DeleteOwnImage is kind of contextual, in order to determine whether it is valid, we need:

To know what image it is trying to delete (from request)
Retrieve the owner of that image (from service or repository)
Compare current user = that owner

Obviously [Authorize] is not enough to do so, but is it possible to do that on custom ActionFilters? Any hint?

Jon · Accepted Answer · 2011-03-05 03:39:02Z

4

Yes, this is possible with a custom action filter. You can extend from AuthorizeAttribute, the most basic implementation being something like:

public class OwnImageAuthorizeAttribute : AuthorizeAttribute {
    public string ImageIdKey { get; set; }

    protected override bool AuthorizeCore(HttpContextBase httpContext) {
    bool authorized = false;
    // Get the current user
    var currentUser = ...;
    // Get the image ID, whether it is in the route or querystring
    int imageId
    if(int.TryParse(httpContext.RouteData.Values(ImageIdKey), out imageId)) {
        // From querystring: httpContext.Request.Querystring[ImageIdKey]
        // Authorize the user
        authorized = YourMethodToCheckIfUserIsOwner(currentUser, imageId);
    }

    return authorized;
}

Then, decorate your method:

[OwnImageAuthorize(ImageIdKey = "imageId")]
public ActionResult MyAction() { }

You can find some more details here.

edited Mar 5, 2011 at 3:39

answered Mar 5, 2011 at 1:52

Jon

4,9453 gold badges30 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Linkgoron Over a year ago

Don't you think that this kind of method of authorization could get out of hand (read: lots of small classes which handle very specific issues) if you start doing this for every DB transaction which requires you to update something in the DB?

xandy Over a year ago

one thing I worried about is the Attribute itself is quite dependent on the input routedata. The "imageId" is named imageId in this action, but in other routing it may became "Id". But I think there's no way to get rid of this, right?

Linkgoron · Accepted Answer · 2011-03-05 02:24:15Z

1

You can easily add something like this in an ActionFilter, Just add an action filter with OnActionExecuting implemented.

Although, depending on your DB schema this could be achieved on the DB level with your query. You could just delete when owner equals recieved recieved id. (I mean, inside the action method and not in the filter)

EDIT: If you're using some kind of IOC container for the repositories, you should look around for the new IOC features in MVC3 (if you're using MVC3) to inject dependencies into your action filters.

http://bradwilson.typepad.com/blog/2010/07/service-location-pt4-filters.html

EDIT2:

BTW, I myself don't really like doing too much business logic in ActionFilters, especially involving calls to the DB. Even more when it's something very specific that'll be used for one action.

edited Mar 5, 2011 at 2:24

answered Mar 5, 2011 at 1:50

Linkgoron

4,8702 gold badges28 silver badges26 bronze badges

1 Comment

xandy Over a year ago

also Ninject-mvc3 can do the injection. I think you are right, that's already stepped into business logic.

Collectives™ on Stack Overflow

Enforce security check in ASP.NET MVC?

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related