Asp.net Mvc: Ajax delete multiple users.

Question

Hello, lets say I got multiple users. They all have items linked to their account. They can CRUD those items.

So now my question is: what's the best way to prevent users from manipulating items from eachother.

At first I thought the antiforgerytoken would help. But it doesn't because when the users look at their control panel they got a valid token. So they could just open firebug and do some post requests to delete items.

While writing this I think I know what I should do. I guess I should just check on the server if the user is deleting his items.

I'll post this question anyway to see if I didn't forget anything which would still make it possible to adjust eachother's items

Answer 1

The only way to be sure is to check on the server that the current user has permission to "do action"

Answer 2

You can use the "Roles" mechanizm (this feature ships with asp.net) to check whether a user can delete other accounts.