ASP.NET MVC preventing users from direct URL

First Create a class for filter: We have to call this feature under OnActionExecuting of Action filter.

using System;
using System.Web.Mvc;
using System.Web.Routing;

namespace Customer.Filters
{
[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
public class PreventFromUrl : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if (filterContext.HttpContext.Request.UrlReferrer == null ||
 filterContext.HttpContext.Request.Url.Host != filterContext.HttpContext.Request.UrlReferrer.Host)
           {
            filterContext.Result = new RedirectToRouteResult(new
                                      RouteValueDictionary(new { controller = "Dashboard", action = "Index", area = "" }));
           }
    }
}
}

Then add [PreventFromUrl] attribute to the top of your action or controller:

 [PreventFromUrl]
 public ActionResult Index()
 {

 }

There's no way to prevent a user to attempting to access any URL. The client (browser) merely makes a request. It is the server's responsibility to determine whether it should return something or not.

Hiding a URL to prevent access is what's called "security by obscurity" and it's basically the same as having no security at all. There is nothing so obscure that a persistent user can't figure it out. You need real security as in role or object-level permissions tied to account authentication.

For a record, you're looking at object-level permissions. The most basic implementation involves creating a foreign key on the object to a user that represents "ownership" of that object. Then, when retrieving the object, you additionally check whether the currently logged-in user is the "owner" and if not, deny access.

public ActionResult Edit(int id)
{
    var foo = db.Foos.Where(m => m.Id == id && m.OwnerId == User.Identity.GetUserId());
    if (foo == null)
    {
        return new HttpNotFoundResult();
    }

    // do whatever for authorized user
}

According to documentation:

ChildActionOnlyAttribute Class

Represents an attribute that is used to indicate that an action method should be called only as a child action.

A child action method renders inline HTML markup for part of a view instead of rendering a whole view.

Any method that is marked with ChildActionOnlyAttribute can be called only with the Action or RenderAction HTML extension methods.

For more information about using attributes, see .

Nkosi is right with his answer. To restrict access to this items you have to perform a user validation inside the Edit action. For example:

public ActionResult Edit(string id)
{
    var user = UserManager.FindById(User.Identity.GetUserId());
    //Check if user can access item
}

For a more flexible approach you can create a custom AuthorizeAttribute for your Controller action method and then set it like this :

[MyAuthorize]    
public ActionResult Edit(string id)
{
    var user = UserManager.FindById(User.Identity.GetUserId());
    //Check if user can access item
}

Then with an extended version of an 'AuthorizeAttribute` you could do your check there:

public class MyAuthorizeAttribute : AuthorizeAttribute
{
    // could be used to set the AD group that you are checking for
    // i.e. [MyAuthorize(strSecurityGroup="domain\group")] in the controller
    public string strSecurityGroup { get; set; }
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var authorized = base.AuthorizeCore(httpContext);
        if (!authorized)
        {
            return false;
        }
        var rd = httpContext.Request.RequestContext.RouteData;
        var id = rd.Values["id"];
        var userName = httpContext.User.Identity.Name;
        //Access the current record through a DataHandler class
        DataHandler dh = new DataHandler();
        // Gets a field from the database that holds the username for the owner of the record
        string createdBy = dh.GetCreatedBy(int.Parse(id.ToString()));
        bool isAuthorized = false;
        if (userName.ToString() == createdBy) isAuthorized = true;
        var User = System.Web.HttpContext.Current.User;
        if (User.IsInRole(@"domain\group")) isAuthorized = true;
        return isAuthorized;
    }
}

This is how I like to do Authorization to AD. You can create a class property in the AuthroizeAttribute to allow you to set the user group separately for each use of the attribute as well. If you are using the authorization mechanism to control actions throughout the site I think that this is cleaner than manually performing an authorization check each time.