How to restrict access of controller action in ASP.net MVC 5

Question

I am learning ASP.Net MVC 5 and I came up to a case where I need to restrict access to controller action under some situations. Suppose I have 5 actions in my controller and I want to restrict two of them in certain scenarios.How to achieve this I know we have inbuilt attributes like [Authorize]. Can I create user-defined restrictions to the controller actions.

Something like:

[SomeRule]
public ActionResult Index()
{
   return View();
}

And if I could create a function or class named "SomeRule" and then add some rules there.Can I add a function/method/class where I can add some logic and restrict the access and redirect to a genreal page if condition does not match. I am a beginner please guide me.

can't u just add routing option to ignore any request to this controller or redirect it to any other page — Mostafa Mohamed Ahmed
– Mostafa Mohamed Ahmed, Commented May 2, 2017 at 20:53

Graham · Accepted Answer · 2017-09-23 05:28:21Z

6

What you'd want to do is create a custom Action Filter, which would allow you to define custom logic within your action to determine if a given user could / could not access the decorated action:

public class SomeRuleAttribute : System.Web.Mvc.ActionFilterAttribute
{
    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        base.OnActionExecuting(filterContext);

        // Define some condition to check here
        if (condition)
        {
            // Redirect the user accordingly
            filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary { { "controller", "Account" }, { "action", "LogOn" } });
        }
    }
}

You can also extend these even further and set properties on them as well if you need to apply some values to check against where the attribute is defined:

public class SomeRule: ActionFilterAttribute
{
    // Any public properties here can be set within the declaration of the filter
    public string YourProperty { get; set; }

    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        base.OnActionExecuting(filterContext);

        // Define some condition to check here
        if (condition && YourProperty == "some value")
        {
            // Redirect the user accordingly
            filterContext.Result = new RedirectToRouteResult(new RouteValueDictionary { { "controller", "Account" }, { "action", "LogOn" } });
        }
    }
}

This would look like the following when used:

[SomeRule(YourProperty = "some value")]
public ActionResult YourControllerAction()
{
     // Code omitted for brevity
}

edited Sep 23, 2017 at 5:28

Graham

7,86020 gold badges67 silver badges92 bronze badges

answered May 2, 2017 at 20:12

Rion Williams

76.9k38 gold badges206 silver badges335 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Unbreakable Over a year ago

If I go for first approach, how my action method should look like?

Unbreakable Over a year ago

I am a beginner, pardon my ignorance.

Unbreakable Over a year ago

Ok, I applied first approach and decorated one action method with [SomeRuleAttribute]. But this SomeRuleAttribute is getting hit even if that controller action is still to be called.

Unbreakable Over a year ago

I decorated only once action with [SomeRuleAttribute]. but even if that action is not called still the class is getting hit. Please guide me

Collectives™ on Stack Overflow

How to restrict access of controller action in ASP.net MVC 5

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related