ASP.NET MVC 3 - How to Limit Areas Effectively?

Question

I have an ASP.NET MVC 3 site with an admin panel (not all of us? :) - I used my own solution for a very reliable login system.

Now, on each view in the administrator controller, I need to check that the user is registered and has proper authorization, so every time I run the same verification and authorization methods on each view separately.

How can I do the same checks for all requests to a specific controller? (I mean, all checks are checked only once and in one place)

(I would also like to have an exception, so I could allow the user to use the login page of the administrator controller and beyond)

Thanks!

Answer 1

Use the attribute on the controller. Either the AuthorizeAttribute standard (see this ), or write your own.

Answer 2

What you are looking for are action filter attributes. They are mainly an attribute that you can place on the controller, which allows you to intercept calls for each action method inside the controller and is therefore ideal for security, as you can reject / accept requests: http://msdn.microsoft.com/ en-us / library / system.web.mvc.actionfilterattribute.aspx

Answer 3

If you want to limit the entire controller instead of separate actions, you can put the [Authorize] attribute as follows:

 [Authorize] public class PageController : Controller { ... }