What is the best way to check if a user has correct rights to run an action?
I have a couple ways in my mind, some which I like more than others:
1) Use the PrincipalPermission attribute which is simple and very low on LOC written. Major con is that it requires a code release (and testing) to make any changes in security.
2) Use the Authorize attribute which seems to be basically the same (at least in this case) as the PrincipalPermission attribute.
3) Use a custom attribute (as discussed here) and read configuration from web.config files a la classic ASP.NET. This has the benefit of being flexible, but I don't like the amount of code I'd have to generate to read in the configuration.
4) Use a custom attribute and read role information from the database. Similar to the previous option, but from a database. I am more inclined to go this route because it gives the greatest flexibility to the users, but it also requires I designate at least one person to change the permissions. This can be made difficult/annoying when utilizing impersonation since the "admin" may not exist in the future.
5) Use either the web.config or db method, but rather than at the attribute level, make a basic method in a base controller class that allows for easy checking of roles. This produces extra code in every single action method, and really doesn't have a benefit other than avoiding the OnActionExecuted method (for trapping purposes).
6) Something else that I have missed...
So which option is the best? Something to remember here is that, at least in my case, making changes to the code requires testing to occur which can be a lengthy and drawn out process. Being able to avoid rebuilding the code seems (to me) to be a major benefit, although I suppose it serves a purpose even with security changes.
(Btw, I see a community wiki button and a warning about subjectivity, but I am not sure if I should check that or what.)