Asp.Net MVC Authorize Options

Question

Have an application were 99% of the actions will require user to be logged in.

The options I've come across are -

1-)Create a base controller inheritance chain and apply authorize attribute at that level. Something like: BaseController > AuthorizeController, BaseController > PublicController. (don't like this because of the inheritance chain)

2-)Create a custom authorize attribute and use a flag to bypass authorization. Similar to this post. (my preference so far).

What are other options/best practice? What about using web.config like in asp.net webforms? Reference here. Does that do the same as the authorize attribute?

Brian Mains · Accepted Answer · 2010-01-15 16:45:17Z

1

Use the tab to and the web config file to control this; you can specify the authorization settings and it does work in MVC too.

http://msdn.microsoft.com/en-us/library/wce3kxhd.aspx

Authorize approach would work, or you could build a custom ControllerActionInvoker (each controller has a reference to this). This class runs on every action invocation, which seems appropriate.

answered Jan 15, 2010 at 16:45

Brian Mains

50.8k35 gold badges155 silver badges260 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

B Z Over a year ago

"Use the tab to" ? not sure what you mean.

Brian Mains Over a year ago

I don't know what I mean by that either :-) Anyway, the authorization element still applies and is a great way to handle this. Other option I specified also works.

Collectives™ on Stack Overflow

Asp.Net MVC Authorize Options

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related