6

The problem I'm trying to solve seems very simple to me: My application has a site-wide menu from which the user can navigate to various areas. The menu items are simply links to ActionResult methods. I'm using a custom AuthorizeAttribute on the actions to enforce the user's authorization roles. That works fine, in that it prevents the user from executing the action if they don't have the appropriate roles. What I want to do, though, is not even show the menu option to navigate to that action if they aren't authorized to perform it.

So, at the simplest level, I want to be able to do something like this:

var isAuthorized = IsAuthorized("ControllerName", "ActionName", currentUser);

The IsAuthorized method would then look at any AuthorizeAttributes on the action, and evaluate whether the given user would be able to execute it.

Does such an approach exist? Assume that we don't have an instance of the controller at the point that we're making this evaluation.

2
  • "a custom AuthorizeAttribute" - do you mean one you've written yourself, or is it one of the built in ones by that name? Commented Sep 21, 2012 at 14:40
  • Yes, one that I wrote myself to implement specific authorization requirements. As in, "public class MyAuthorizeAttribute : AuthorizeAttribute"
    – Dan
    Commented Sep 21, 2012 at 14:45

1 Answer 1

6

A second pass at searching for an approach to this actually resulted in exactly what I was looking for. I'll leave this question here in case it leads others to this answer.

Create an authorized action link extension for ASP.NET MVC 3

The implementation uses just about exactly the syntax I was looking for, and works in practice.

1
  • You should mark it as answered, even if you are the answerer.
    – labilbe
    Commented Nov 6, 2013 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.