How do I restrict access to certain pages in ASP.NET MVC?

Question

Hi,

I wish to lock out access to html page (eg. /manual/manual_A/index.html) if a certain condition is not met (eg. HttpContext.Current.Request.Form["key"].toString().Equals("a") ), I wish redirect to specific view (eg. /errorPage/) else continue (eg. /index). In register Route I add:

routes.MapRoute(
                "ErrorPage",                                             
               "errorPage/",                          
                new { controller = "Home", action = "ErrorPage" } 
            );

routes.MapRoute(
                "Path",                                             
               "{*_request}",                          
                new { controller = "Home", action = "Index" } 
            );

for read all request. In controller Home

[CustomAuthorize] 
   public ActionResult Index()
   {

   }

protected override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        if(!condition)
          filterContext.Result = RedirectToAction("PageError");
    }

OnActionExecuting executes on every request, however, RedirectToAction does not happen. Any hints as to what I'm doing wrong?

Answer 1

You need to set your filterContext.Result like shown below and then redirect to your error page.

filterContext.Result = new EmptyResult();
RedirectToAction("PageError");

That should fix the problem.

Answer 2

This is my solution. In Globax.asax:

public static void RegisterRoutes(RouteCollection routes)
{
    routes.RouteExistingFiles = true;
    routes.MapRoute("PageError", "PageError/", new { controller = "Home", action = "PageError" });
    routes.MapRoute("PathPageStatic", "PathPageStatic/", new { controller = "Home", action = "PathPageStatic" });
    routes.MapRoute("Path", "{*_request}", new { controller = "Home", action = "Index"});
}

In Controller, I use a Session to memory the condition:

public ActionResult PathPageStatic()
{
   if (condition)
   {
     Session["key"] = condition;
     return View("Index");
   }
   else
     return RedirectToRoute("PageError");
}

[UserAuthorize]
public ActionResult Index()
{
   string patternStaticFile = @"\.*.(htm|html)";
   if (Regex.IsMatch(HttpContext.Request.Url.AbsoluteUri, patternStaticFile))
   {
      string pathFile = HttpContext.Request.Url.LocalPath;
      if (System.IO.File.Exists(pathFile))
         return new FilePathResult(pathFile, MimeType(pathFile));
      else return null;
   }
   else
      return View();
}

public ActionResult PageError()
{
   return View("PageError");
}

In AuthorizeAttribute:

public override void OnAuthorization(AuthorizationContext filterContext)
{
    if (HttpContext.Current.Session["key"] == null)
        filterContext.HttpContext.Response.Redirect("~/PageError", true);
}