Dynamic Security for ASP.NET MVC

Question

I am developing an application in ASP.NET MVC, and the usual way to protect actions is to use an attribute Authorizethat protects the entire action.

[Authorize(Roles = "Managers")]
public AtionResult Info(int employeeId )

However, in our design, the application is data driven. Actions on one data set may be allowed, but not allowed on another data set.

// OK
http: // host / Employee / Info / 102

// Not OK
http: // host / Employee / Info / 105

Which template should we use for security for this project?

Answer 1

You can create a derived Authorize attribute to do whatever you want.

public class DynamicSecurity : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        //go to db
        return true;
    }
}

Answer 2

, ActionFilterAttribute, OnActionExecuting - , - , / / , .