I am new to .NET, MVC & Identity Framework. I noticed the identity framework allows for securing individual controller actions via annotations.
[Authorize]
public ActionResult Edit(int? Id){
//edit action
}
I would like to secure certain actions based on user permissions.
Example : A blog application where only the user who created a blog post can edit.
With this in mind, is it possible to perform either option below? If so, are there resources and examples on how to best achieve?
[Authorize(Entity = "Entry", Permission = "Edit", Id = Id)]
public ActionResult Edit(int? Id){
//edit action
}
or
[BlogEntryPermission(Permission = "Edit", Id = Id)]
public ActionResult Edit(int? Id){
//edit action
}
Where blog Id
is captured from the request.
Any information or direction on permission based authentication would be most appreciated. Thanks in advance for your help.
You can implement your custom AuthorizationAttribute
where you will specify your parameters and can get a blogId
from request
public class AuthorizeEntryPermission : AuthorizeAttribute
{
public string Permission { get; set; }
public AuthorizeEntryPermission(){
}
public AuthorizeEntryPermission(string Permission)
{
this.Permission = Permission;
}
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
var id = context.Request.RequestContext.RouteData.Values["Id"];
//check your permissions
}
public override void OnAuthorization(AuthorizationContext filterContext)
{
if (AuthorizeCore(filterContext.HttpContext))
{
// ** IMPORTANT **
// Since we're performing authorization at the action level, the authorization code runs
// after the output caching module. In the worst case this could allow an authorized user
// to cause the page to be cached, then an unauthorized user would later be served the
// cached page. We work around this by telling proxies not to cache the sensitive page,
// then we hook our custom authorization code into the caching mechanism so that we have
// the final say on whether a page should be served from the cache.
HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
cachePolicy.SetProxyMaxAge(new TimeSpan(0));
cachePolicy.AddValidationCallback(CacheValidateHandler, null /* data */);
}
else
{
//handle no permission
}
}
private void CacheValidateHandler(HttpContext context, object data, ref HttpValidationStatus validationStatus)
{
validationStatus = OnCacheAuthorization(new HttpContextWrapper(context));
}
}
Then use it like this:
[AuthorizeEntryPermission(Permission = "Edit")]
public ActionResult Edit(int? Id){
//edit action
}