Finding mvc3 action method parameters in custom attribute

Question

I am working on implementing user right management on an mvc3 application.

I have defined my action methods on database with ControllerName, ActionName, and Parameters consists ParameterName and ParameterType etc.

I implemented a custom attribute which inherited from Authorize attribute.

What i am trying to do is finding the action executing among my built-in actions defined on database and calculating if user has permission on specified action or not.

The code is like this;

[HttpPost]
[MyAuthorize]
public ActionResult Edit(VendorPageItem entity)
{
  //...
}

public class MyAuthorize: System.Web.Mvc.AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (httpContext == null)
            throw new ArgumentNullException("httpContext");

        string controller = httpContext.Request.RequestContext.RouteData.Values["controller"].ToString();
        string action = httpContext.Request.RequestContext.RouteData.Values["action"].ToString();
        int userId = SessionState.Current.LoginParameter.VendorUserID;

        List<string> parameterTypes = new List<string>();
        //TODO: Find out action method parameter types. 

        return IoCWorker.Resolve<IUserRightService>().HasUserRightToAction(userId, controller, action, parameterTypes);
    }
}

My problem is finding the method parameter types in my custom attribute.

Thanks.

edit: forgot to mention that is post action. [HttpPost] added.

I have played around with AuthorizeAttribute this way, but have found that it's easier just to check permissions in the controller method. — Robert Harvey
– Robert Harvey, Commented Feb 23, 2012 at 16:01

Matteo Mosca · Accepted Answer · 2011-12-09 09:16:18Z

2

I think reflection is the answer here.

Once you have the controller and the action, and assuming you know beforehand the namespace, you can inspect the controller Type and drill down to its methods and relative signatures/overloads.

Also inspecting the full contents of RouteData apart from controller and action can tell you what it being passed to the method.

I haven't tried it out, but from what you say it seems it will work this way.

answered Dec 9, 2011 at 9:16

Matteo Mosca

7,4684 gold badges47 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

berdem Over a year ago

I have folders like "Definitions", "Management", "Commons" under Controllers folder. So namespaces is different. I tryed to navigate httpContext in AuthorizeCore method about finding action parameter info but no luck.

slfan · Accepted Answer · 2011-12-09 12:20:20Z

1

I'm not sure whether I understood your question properly. If you try to access the parameter values, I have an answer for you, if you really want to know the parameter types, then @Matteo Mosca's answer will be correct:

That depends on where the parameters come from. Whether they are QueryString parameters or form parameters or cookies or...

The model binder infrastructure of ASP.NET tries to map the parameters on the action method. In your custom attribure you can access the parameters with the context, e.g.

string input = httpContext.Request.Form["myInput"]

EDIT: This is of course not the nicest solution because you need information about the posted parameters. As I don't know your real requirements, I can't make any better suggestion. Of course you could iterate through the Form collection.

A possiblilty could be that you pass the name of the field as a parameter/property of the MyAuthorizeAttribute.

edited Dec 9, 2011 at 12:20

answered Dec 9, 2011 at 9:16

slfan

9,129115 gold badges69 silver badges81 bronze badges

4 Comments

berdem Over a year ago

my action method is a post aciton and i use jquery post. so i do not have query string :(.

slfan Over a year ago

ok, but you can access the Forms collection in the same way. I'm not sure yet whether it works with an AJAX request.

berdem Over a year ago

I can get form collection, but what i am seeing in it form control keys and values. e.g: as key ModelName.Entity.Name, and its value. But i have no "VendorPageItem" type on that form collection.

slfan Over a year ago

That's right, you only see the properties of VendorPageItem. The modelbinder can map the form content to the properties of the class. I'm not sure whether you have access to the bound data.

Collectives™ on Stack Overflow

Finding mvc3 action method parameters in custom attribute

2 Answers 2

1 Comment

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related