Writing Custom Attribute in C# like ASP.Net MVC Authorize attribute

Question

Hi,

I like ASP.Net MVC Authorize attribute, I can extend it and build my own logic and decorate my controller with it. BUT,

In my architecture, I have one common service layer(C# Class Library). End user can access my application via ASP.Net MVC web site or via my exposed REST WCF Webservice layer. My asp.net MVC application and REST WCF service layer both in turn access my common service layer.

I want authorization to happen in this common service layer and not in ASP.Net MVC Controller or in my exposed REST Service layer.

Can I create ASP.Net MVC Authorize attribute like thing to decorate my methods in the common C# class library? This attribute will take parameters and will decide if the current user has access to perform that function or not?

Thanks & Regards, Ajay

Answer 1

No, AuthorizeAttribute works because the MVC framework explicitly invokes it before calling the method. A similar feature for your service layer would only work if your clients explicitly invoked it, as well. It would not be reasonable to presume that even a well-intentioned client would always remember to look for the attribute and invoke it. WCF has its own security. You should use that instead of writing your own.

Answer 2

This shouldn't be too hard to do - there are a couple of places that you could reflect out the attribute and handle it accordingly:

• On application start in Global.asx you can customise routing and locations for views

• Underlying ASP.Net request events still fire, so you could override one of them

• Create your own base controller and override OnActionExecuting

---

Update following comment

Ahh, I see. In that case if you're making direct calls then you should check out Code Access Security, which I think covers what you mean.

Alternatively a custom attribute might make sense as long as you are using some kind of factory pattern - then the reflection call that gets the factory could check the attributes.

If you're not using reflection to retrieve your classes or call your methods (which is essentially what routing does in MVC) then you won't get the chance to check your attributes.

Answer 3

What you're looking for can be achieved using AOP library, like PostSharp (http://www.postsharp.org/). It's more complex than using Authorize attribute in mvc, but is still quite simple.

Answer 4

Another way to handle this is to use the [PrincipalPermission] attribute in your service layer. This can prevent callers from executing a method (or accessing an entire class) without the defined authorization.