Using action parameters in custom Authorization Attribute in ASP.NET MVC3

Question

I have a controller which should only request authorization when loaded with specific parameters. Like when the parameter ID is 8 for example.

I came up with using a custom validation attribute like this:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (/* Action's inputparameter ID = 8 */)
        {
        return base.AuthorizeCore(httpContext);
        }
        return true;
    }
}

My action looks like this (not that it is interesting)

[MyAuthorize]
public ActionResult Protected(int id)
{
    /* custom logic for setting the viewmodel from the id parameter */
    return View(viewmodel);
}

The problem is as you can see that I don't know how to check for that ID parameter in the authorize attribute. Can you help me with a solution?

Darin Dimitrov · Accepted Answer · 2011-04-05 15:31:54Z

33

If the id is passed as request parameter (GET or POST) or as a route data parameter:

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    // first look at routedata then at request parameter:
    var id = (httpContext.Request.RequestContext.RouteData.Values["id"] as string) 
             ??
             (httpContext.Request["id"] as string);
    if (id == "8")
    {
        return base.AuthorizeCore(httpContext);
    }
    return true;
}

edited Apr 5, 2011 at 15:31

answered Apr 5, 2011 at 15:25

Darin Dimitrov

1.0m275 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Herman Kan Over a year ago

The code is redundant, please see my solution below.

qurban Over a year ago

@Darin, Can you please tell me if the input parameter of the action is a model, how to retrieve that model object instead of named parameters?

Worthy7 Over a year ago

It sounds like you're actually looking for stackoverflow.com/questions/1335315/…

Herman Kan · Accepted Answer · 2014-07-08 11:51:53Z

10

As long as AuthorizeAttribute is being inherited, you can get your parameter from AuthorizationContext, as follows:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        string idParam = filterContext.Controller.ValueProvider.GetValue("id").AttemptedValue;
        int id;

        if (int.TryParse(idParam, out id))
        {
            if (id == 8) // apply your business logic here
                return;
        }

        filterContext.Result = new HttpUnauthorizedResult();
    }
}

[MyAuthorize]
public ActionResult Protected(int id)
{
    return View();
}

The ValueProvider will iterate through all registered providers that by default includes RouteDataValueProvider, QueryStringValueProvider and FormValueProvider, and do all the work for you.

Otherwise I recommend using ActionFilterAttribute.

edited Jul 8, 2014 at 11:51

answered Jul 4, 2014 at 14:24

Herman Kan

2,2921 gold badge26 silver badges34 bronze badges

2 Comments

vinczemarton Over a year ago

This does not fully answer my question. I wanted to enable/disable authorization depending on the value of the id parameter. Is there a way to affect the Authorization from the OnAuthorization handler? Can you elaborate on the ... part of your answer?

Herman Kan Over a year ago

@SoonDead, I changed my example. As you can see, it is still quite simple, yet fully functional.

4imble · Accepted Answer · 2011-04-05 09:22:35Z

2

You need something like this.

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        int? id = GetId(filterContext);

        if (id.HasValue)
        {
          ...
        }
    }

    private static int? GetId(ActionExecutingContext filterContext)
    {
        int? Id = null;

        if (filterContext.ActionParameters.ContainsKey("Id"))
        {
            Id = (int?)filterContext.ActionParameters["Id"];
        }
    }

answered Apr 5, 2011 at 9:22

4imble

14.5k15 gold badges77 silver badges133 bronze badges

2 Comments

vinczemarton Over a year ago

Yeah something like that, but I have a HttpContextBase parameter in the AuthorizeCore method, not an ActionExecutingContext. And I don't know how can I write authorization logic in the OnActionExecuting method.

Michael La Voie Over a year ago

Here is a great article explaining how to access ActionParameters for authorization purposes: joe-stevens.com/2010/08/19/…

user7778268 · Accepted Answer · 2017-06-12 08:59:43Z

1

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var rd = httpContext.Request.RequestContext.RouteData;
        string currentAction = rd.GetRequiredString("action");
        string actionparam =Convert.ToString(rd.Values["param"]);

        if (id == actionparam)
        {
            return base.AuthorizeCore(httpContext);
        }
return true;
 }

answered Jun 12, 2017 at 8:59

user7778268

115 bronze badges

1 Comment

vinczemarton Over a year ago

How does this differ from Darin Dimitrov's answer exactly?

Collectives™ on Stack Overflow

Using action parameters in custom Authorization Attribute in ASP.NET MVC3

4 Answers 4

3 Comments

2 Comments

2 Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

3 Comments

2 Comments

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related