Using authorize attribute ASP.Net MVC

Question

I use Authorize attribute to check if user is authorized or not to enter special view.

    [HttpGet]
    [Authorize]
    public ActionResult Index(int ID)
    {
             ViewBag.sID = ID;
             return View();
    }

Suppose this is mu URL : localhost:16621/Panel/Index/1 Now this authorized user can change 1 to 2 and navigate to another user information. Like localhost:16621/Panel/Index/2 How to prevent from this??? Is there any way to pass parameter to authorize attribute? How to prevent user from access another user information?

Angelina. this is so many time already asked on SO. stackoverflow.com/questions/2329197/… stackoverflow.com/questions/427598/… stackoverflow.com/questions/554094/… — Ashwini Verma
– Ashwini Verma, Commented Jul 8, 2013 at 15:17
Look into this post, it does exactly what you want it to. stackoverflow.com/questions/10064631/… — SOfanatic
– SOfanatic, Commented Jul 8, 2013 at 16:31

Ondrej Svejdar · Accepted Answer · 2013-07-08 15:20:30Z

4

I'm afraid there is no magical switch - [Authorize] just kick off unauthorized users, users that are not within specified range, or users in wrong role. Safety of context-bound data is up to you - you'll have to do it within Index() body and redirect user elsewhere if the passed id is not available for actual user.

answered Jul 8, 2013 at 15:20

Ondrej Svejdar

22.2k5 gold badges60 silver badges93 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ataravati Over a year ago

This is not a good solution. It's better to use a custom authorize attribute.

s.meijer · Accepted Answer · 2013-12-23 16:54:46Z

There is a "AuthenticationFilter" ASP.NET MVC5 available for exactly this purpose.

Authentication filters

Authentication filters are a new kind of filter in ASP.NET MVC that run prior to authorization filters in the ASP.NET MVC pipeline and allow you to specify authentication logic per-action, per-controller, or globally for all controllers. Authentication filters process credentials in the request and provide a corresponding principal. Authentication filters can also add authentication challenges in response to unauthorized requests.

See this tutorial for how to use it.

using System.Web.Mvc;
using System.Web.Mvc.Filters;

namespace VSMMvc5AuthFilterDemo.CustomAttributes
{
  public class BasicAuthAttribute : ActionFilterAttribute, IAuthenticationFilter
  {
    public void OnAuthentication(AuthenticationContext filterContext)
    {
    }

    public void OnAuthenticationChallenge(AuthenticationChallengeContext filterContext)
    {
      var user = filterContext.HttpContext.User;
      if (user == null || !user.Identity.IsAuthenticated)
      {
        filterContext.Result = new HttpUnauthorizedResult();
      }
    }
  }
}

Collectives™ on Stack Overflow

Using authorize attribute ASP.Net MVC

2 Answers 2

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related