Why are ASP.Net MVC2 area controller actions callable without including the area in the url path?

Question

I've just installed Visual Studio 2010 and have created a new MVC2 project so that I can learn about the changes and updates and have discovered an issue with areas that I'm not sure what to make of.

1. I created a new EMPTY MVC2 project
2. I right clicked the project and, from the context menu, added a new area called "Test"
3. In the new test area, I added a controller called "Data".

The code is:

public class DataController : Controller
{
    //
    // GET: /Test/Data/

    public ActionResult Index()
    {
        Response.Write("Hi");
        return new EmptyResult();
    }
}

Now, I compile and call this address: http://localhost/mytest/test/data and get the output:

Hi

All good. Now I call this: http://localhost/mytest/data and get the same response! I thought routing was supposed to take care of this? Am I overlooking something? Or has the default project setup for MVC2 overlooked something?

Answer 1

This is intentional. The default route in Global.asax does not limit its search to a particular area or set of namespaces. There are overloads of MapRoute (see one example on MSDN) which take a namespaces parameter, which can be used to disambiguate which controller was meant by this request. But even so, the namespaces parameter is just a hint about which namespaces to search in first; it's not a restriction.

In short, in MVC, you have to be prepared for any of your controllers to be hit by any route. This is why all of the MVC documentation states that security and other logic should be done at the controller level, never at the route level.