ASP.NET MVC : Context sensitive validation

Question

I have bunch of action-methods that need to verify the ownership of the orderId passed to the action something like:

public ActionResult CancelOrder(int orderId) {
    If (!MyDatabase.VerifyOwnership(orderId, User.Identity.Name) return View("You are an imposter!");
    // ...
}

What's an easy way to verify orderId belongs to User.IdentityName without having to copy/paste same lines over and over?

I have tried ActionFilterAttribute but it doesn't have access to the context (MyDatabase object for example). What's a good way to handle this?

John Farrell · Accepted Answer · 2010-01-16 19:01:07Z

1

" but it doesn't have an access to the context"

Sure it does:

public class VerifyOwner : ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        var myController = (MyControllerType)filterContext.Controller;

        if (!myController.MyDatabase.VerifyOwnership(orderId, User.Identity.Name) 
            //do what you do

        base.OnActionExecuting(filterContext);
    }
}

All you have to do is cast the Controller property to your controller type. This get really easy is you have a custom base Controller all your Controllers inherit from. Then set that base controller to have the MyDatabase property and you have an easy time using this attribute across multiple controllers.

answered Jan 16, 2010 at 19:01

John Farrell

24.7k10 gold badges82 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Daniel Elliott · Accepted Answer · 2010-01-16 18:54:00Z

1

Your controller seems to have access to your context. Therefore if you use an action filter attribute that implements IAuthorizationFilter you can cast the filterContext.Controller in the OnAuthorization method to your controller type and be able to do what you set out to in the first place. (Which I reckon is the way to go!)

Kindness,

Dan

answered Jan 16, 2010 at 18:54

Daniel Elliott

22.9k10 gold badges67 silver badges82 bronze badges

2 Comments

THX-1138 Over a year ago

I was trying to avoid down cast, but I guess it's better than singleton.

Daniel Elliott Over a year ago

One thing to bear in mind ... if you don't use IAuthorizationFilter then another filter on the same method could run before your "you are an imposter!" filter ;)

Collectives™ on Stack Overflow

ASP.NET MVC : Context sensitive validation

2 Answers 2

Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related