how to correctly deal with unwanted access from asp.net-mvc (mostly id part)

Question

let say I have this url:

http://myweb/item/info/1

with a link to

http://myweb/item/edit/1

and I don't want the user to manually change to

http://myweb/item/edit/2

I would want the user to click on the link from the info page so he can access the edit page.

how would you manage that?

Answer 1

Personally I wouldn't want to stop a user doing that; it's not terribly intuitive for a URL to work in one context and not in another.

Instead I would ensure that the user has permission to edit the item in question as part of the controller method for the 'edit' action and redirect to an error page if they do not.