how to provide access to controler by special code in link

Question

i have some controlers that provide access only to users that are in Admin role:

[Authorize(Roles = "Administrators")]

controler im talking about displays company details for customers and i want to provide access to that controler by some url for example:

www.mysite.com/Company/123?code=0932840329809u0932840

generating code will not be a problem, problem is what is the best solution to provide access to controler via that secret url AND access without secret url only for administrators? thnx!

Answer 1

You could create a custom attribute filter by extending the AuthorizeAttribute.

Something like:

public class CustomAuthorizeAttribute : AuthorizeAttribute {

  public string Code { get; set; }

  protected override bool AuthorizeCore(HttpContextBase httpContext) {
    if (base.AuthorizeCore(httpContext)) {
      return true;
    }

    string code = Code ?? GetCode() //parse you code as a parameter or get it from another method
    if (httpContext.Request["code"] == code) {
      return true;
    }

    return false;
  }

}


//I wouldn't recommend parsing the code like this, I would get it in your action filter
[CustomAuthorizeAttribute(Code="0932840329809u0932840")]
public ActionResult Index() {
  return View();
}

Have a look at http://schotime.net/blog/index.php/2009/02/17/custom-authorization-with-aspnet-mvc/