How to use custom Authorize attribute for roles as well as a specific user?

Question

I have my Action Method

[Authorize(Roles="Admin")]
public ActionResult EditPosts(int id)
{
    return View();
}

In my case I need to authorize administrators so they can edit posts but (here comes the cool part), I also need to allow the creator of the post to be able to edit the post which is a normal user. So how can I filter out the user that created the post as well as the admins but leave the others unauthorized? I am receiving the PostEntry id as a route parameter but that's after the attribute and also attributes only accept constant parameters, looks like something very difficult, your answers are highly appreciated, Cheers!

Since you may not know who created the post until you look it up. It might be better to include this logic after hydrating the object. Otherwise, if you implement this as an aspect, you might have to look up the post twice (once for authorization and once for editing). — Davin Tryon, Jul 15 '12 at 17:20
a point well put, indeed i will once look up if his id is on the role entry and again to do my controller logic. Any ideas how to hit the database just once? — Freeman, Jul 15 '12 at 17:56
Thinking about this a bit more, if you are using a good ORM, and setting your context up before the authorization call (not sure about that part), then it should cache in the 1st level cache. Then, you shouldn't see as bit of a hit on the second hydrate. — Davin Tryon, Jul 15 '12 at 20:13
I am indeed using Entity Framework 4.0, but i don't think it chaches anything. — Freeman, Jul 16 '12 at 06:36

score 74 · Accepted Answer · edited Oct 15 '14 at 17:56

74

You could write a custom authorize attribute:

public class AuthorizeAdminOrOwnerOfPostAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var authorized = base.AuthorizeCore(httpContext);
        if (!authorized)
        {
            // The user is not authenticated
            return false;
        }

        var user = httpContext.User;
        if (user.IsInRole("Admin"))
        {
            // Administrator => let him in
            return true;
        }

        var rd = httpContext.Request.RequestContext.RouteData;
        var id = rd.Values["id"] as string;
        if (string.IsNullOrEmpty(id))
        {
            // No id was specified => we do not allow access
            return false;
        }

        return IsOwnerOfPost(user.Identity.Name, id);
    }

    private bool IsOwnerOfPost(string username, string postId)
    {
        // TODO: you know what to do here
        throw new NotImplementedException();
    }
}

and then decorate your controller action with it:

[AuthorizeAdminOrOwnerOfPost]
public ActionResult EditPosts(int id)
{
    return View();
}

edited Oct 15 '14 at 17:56

Royi Namir

144,742
138
468
792

answered Jul 15 '12 at 17:30

Darin Dimitrov

1,023,142
271
3,287
2,928

Why _// Now id was specified => we do not allow access_ ? – Royi Namir Oct 14 '14 at 09:12
**Now I see** you need to change : _// Now id was specified_ to **NO** id was specified....(it seems that if there is ID we dont allow access) – Royi Namir Oct 14 '14 at 09:14
Thank you -- cuts through the flak that is out there and gets right to the point! – cyclical Mar 16 '15 at 21:19
This post is very useful as it helped me to make possible to allow all the roles in the mvc application except the "user" role for some controller. – Sorangwala Abbasali Nov 28 '16 at 11:18

Traderhut Games · Answer 2 · 2018-08-08T20:52:46.510

I understand that you have already accepted an answer, and this was posted a while back.. (btw:excellent answer for adding custom attributes), However I would point out the following:

If you are using this attribute once. On a Single method. This isn't a good implementation. Instead you should have:

[Authorize]   // Just make sure they are auth'ed at all.
public ActionResult EditPosts(int id)
{
    Post SomePost = findPostByID (id);   // However you do it - single lookup of post

    if (!user.IsInRole("Admin") &&  !{IsOwnerOfPost(post)} )  Return Not Authorized

  ... Edit post code here
}

This has the advantages of:

No additional class that someone will later wonder where it is used.
No class that isn't usable anywhere else (you don't gain reuse with a custom attribute)
Performance is better: Single fetch of the Post
Way easier for someone to read/figure out how it works. No magic code to track down.
And Years later, when HttpContextBase class doesn't exist, or other parts of the tricks used to fetch the Id parameter are gone, the code still works...

How to use custom Authorize attribute for roles as well as a specific user?

2 Answers2

Linked