Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>My only recommendation would be to write an extensions methods on <code>IPrincipal</code> instead which would look like </p> <pre><code>public static bool HasRolesAndPermissions(this IPrincipal instance, string roles, string permissions,) { if(user not authenticated) return false; if(user has any role of Roles) return true; if(user has any permission of Permissions) return true; return false; } </code></pre> <p>Then your code in the views/partials is a little more readable in terms of what it's actually doing (not doing anything with html, but validating a user) then the code in the views/partials looks like </p> <pre><code>@if (User.HasRolesAndPermissions(roles, permissions)) { @Html.ActionLink(..); } </code></pre> <p>Each MVC Page has the property <a href="http://msdn.microsoft.com/en-us/library/system.web.webpages.webpagerenderingbase.user%28v=vs.98%29.aspx" rel="nofollow">WebViewPage.User</a> for the current user.</p> <p>The problem with your purposed solution (and the link to security aware link) is that the creation of the link, and the Authorize on the controllers could be different (and mixing responsibilities in this type of fashion in MY opinion is bad practice). By extending <code>IPrincipal</code> a new authorization would look like:</p> <pre><code>protected override bool AuthorizeCore(HttpContextBase httpContext) { return user.HasRolesAndPermissions(roles, permissions) } </code></pre> <p>Now both your Authorize Attribute and Views use the same roles/permissions data logic.</p>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload