Document Based Security in ASP.NET MVC

Question

I already know about user and role-level security in ASP.NET MVC. But now I need something more granular.

Let's say I have a list of documents, some of which are allowed for the user, and some are not. Each document has a corresponding entry in the table of documents in the database. Documents can be downloaded for viewing if the user has access to security. Documents can also be added if you have this role. Each document has a URL, and each list of documents has a URL.

I would like the security system to crop the list so that the user sees only those documents for which he is allowed. But I also need to authenticate the URL requests for these lists and documents, since there is nothing that will prevent the bookmarking user of the document, which they no longer have access to, or just enter the URL into the browser.

Does the built-in role-based security model fit or need separate table-based security? Can I set protection in my repository so that the returned records are already trimmed or are part of the controller? Do I need a security attribute to validate a controller request, or should I just put it in the controller method as the first few lines of code?

Answer 1

@Robert, I think you already answered your question when you said that you should trim them (before) they reach the point of view. So, in your business logic, as a preference over the repository, you might want to make lamda to trim the excess, so to speak.

It seems to me that I will never return any entries to the view that the user was forbidden to see. Why increase risk and traffic?

As for bookmarks, I think you will need to do some business logic so that they don’t go to the URL when access no longer exists.

, , , - , -.

, , , , .

Answer 2

, . : , , , .. , , - , -, .

, .

, ?

, ?

- , -, - .

?

- , , -, , .

- , :

public class LoggedUserFilterAttribute : ActionFilterAttribute
{
    public bool Logged { get; set; }
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if (!SessionManager.IsUserLogged)
        {
            filterContext.Result = new RedirectToRouteResult(GetRedirectToNotLoggedRouteValues());
            this.Logged = false;
        }
        else
            this.Logged = true;
    }

    public RouteValueDictionary GetRedirectToNotAuthorizedRouteValues()
    {
        RouteValueDictionary routeValues = new RouteValueDictionary();
        routeValues.Add("action", "NotAuthorized");
        routeValues.Add("controller", "Authorization");
        return routeValues;
    }
    public RouteValueDictionary GetRedirectToNotLoggedRouteValues()
    {
        RouteValueDictionary routeValues = new RouteValueDictionary();
        routeValues.Add("action", "NotLogged");
        routeValues.Add("controller", "Authorization");
        return routeValues;
    }
}

, , , :

public class SuperUserFilterAttribute : LoggedUserFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        base.OnActionExecuting(filterContext);

        if (Logged)
        {
            MyBaseController controller = filterContext.Controller as MyBaseController;
            if (controller == null)
                throw new Exception("Please use MyBaseController instead of built in Controller");

            User loggedUser = controller.Model.UserBO.GetUserByID(SessionManager.LoggedUser.UserID);

            if(!loggedUser.IsSuperUser)
            {
                filterContext.Result = new RedirectToRouteResult(GetRedirectToNotAuthorizedRouteValues());
            }
        }
    }
}

MyBaseController - , Controller Model, -. , , , :

    [LoggedUserFilter]
    public ActionResult LoadSomeEntity(int customerServiceID,int entityID)
    {
        UserRights userPermissionsView = Model.SecurityBO.GetUsersRightsOnEntity(SessionManager.LoggedUser.UserID, entityID);

        if(userPermissionsView.Write) 
            return View("EditEntity",Model.EntityBO.GetEntityByID(entityID));
        if(userPermissionsView.Read) 
            return View("ViewEntity",Model.EntityBO.GetEntityByID(entityID));

        return View("NotAuthorized");     
    }

p.s. , - -, , , , :), , , .