Implement object-level security with attributes in ASP.NET MVC

Question

Is it possible to implement object level protection with ActionFilterAttribute?

I read Branislav Abadzhimarinov responded to Get permission from an authorized attribute? and began to think about creating a AuthorizeAttribute-shaped action filter to implement object-level protection.

Suppose I had to call it ObjectAuthorizeAttributewith the intended use:

[ObjectAuthorize]
public ActionResult Edit(int id)
{
    //...

What would be the easiest way to access the id value in OnActionExecuting?

Is something like this already available?

Answer 1

AuthorizeAttribute , RouteData, AuthorizationContext. , , AuthorizeAttribute, ActionFilterAttribute.

var id = filterContext.RouteData.Values["id"];

Answer 2

var id = filterContext.HttpContext.Request["id"];