security - how to asp.net mvc permission by action? -
security - how to asp.net mvc permission by action? -
i need create custom authorization , authentication user security looping on area/controller/action list (that dynamically saved in database) , action assign user admin , solution? (i need dynamic authorization , authentication instead of authorization tag on action. how can write it?)
one of main selling points of mvc architecture decoupling interface, views or urls, underlying architecture of controllers, actions, etc. you're proposing isn't horrible, it's not ideal, either. if need add together new action? if need remove action. if need move duties of 1 action different action. of these things fundamentally alter permissions, requiring lot of maintenance.
this job improve suited roles, , that's roles exist for. if want command can edit widget, don't give them explicit access widgetarea > widgetcontroller > editwidget; give them role of caneditwidget
. then, action involves editing widgets can protected role. not allows go on using authorize
attribute , avoi custom code, portability. if underlying architecture changes, permission scheme unaffected.
asp.net-mvc security action
Comments
Post a Comment