Securing a mvc view so only the server can access it

Question

I'm building a .Net MVC app, where I'm using one particular view to generate an internal report. I don't want the users of the site to gain access to this page at all.

I've a console app that fires every so often which will scrape some of the details from this page by hitting it's URL.

I don't like the idea of having the URL hanging out there but I'm not sure of another way to go about it.

Thoughts on what might be the best practice way for tackling this?

Edit:

Here's what I ended up doing, created a new WCF Service project in the solution. I also copied basically what was the MVC view page into a new standard web forms page in this project. On top of adding security via the regular .net Authentication methods (eg set only valid windows users can access the page), I can also lock down the vhost to only be accessed by certain IP's.

Answer 1

If the view never needs to be rendered at all except to provide data for the console app, then why not have the console app simply connect to your database to get the data directly instead of going through the web app? You could still do this for the console app even if the view does need to be available for some users, then control access to the view using the Authorization attribute, which could suitably restricted now that an external app need not have access to it.

Answer 2

The best practice would be to expose a wcf service for this, and set up a security model that is different than website.

If you must use MVC the best approach use forms authentication with mvc and set

[Authorize(Roles = "SecureUser")]

On the View.