security - how to asp.net mvc permission by action? -



security - how to asp.net mvc permission by action? -

i need create custom authorization , authentication user security looping on area/controller/action list (that dynamically saved in database) , action assign user admin , solution? (i need dynamic authorization , authentication instead of authorization tag on action. how can write it?)

one of main selling points of mvc architecture decoupling interface, views or urls, underlying architecture of controllers, actions, etc. you're proposing isn't horrible, it's not ideal, either. if need add together new action? if need remove action. if need move duties of 1 action different action. of these things fundamentally alter permissions, requiring lot of maintenance.

this job improve suited roles, , that's roles exist for. if want command can edit widget, don't give them explicit access widgetarea > widgetcontroller > editwidget; give them role of caneditwidget. then, action involves editing widgets can protected role. not allows go on using authorize attribute , avoi custom code, portability. if underlying architecture changes, permission scheme unaffected.

asp.net-mvc security action

Comments

Popular posts from this blog

formatting - SAS SQL Datepart function returning odd values -

c++ - Apple Mach-O Linker Error(Duplicate Symbols For Architecture armv7) -

php - Yii 2: Unable to find a class into the extension 'yii2-admin' -