ASP.NET MVC Route Params Authorization

Question

My site allows people to edit posts. I want people to only edit their posts. I need an authorization attribute, for example:

[CanEditPost(PostId = Id)] ActionResult Edit(int Id) { } 

But it looks like the attribute parameters should be static, which makes this impossible. Is there any way around this?

Answer 1

Yes.

If you create an attribute that inherits from AuthorizeAttribute ,

You must have access to the route parameters:

 protected override bool AuthorizeCore(HttpContextBase httpContext) { var postId = httpContext.Request.RequestContext.RouteData.Values["Id"]; . . . }