How do I restrict access to certain pages in ASP.NET MVC?

Question

I wish to lock out access to a user's EDIT page (eg. /user/pure.krome/edit) if

a) Identity.IsAuthenticated = false

or they are authenticated but

b) Idenitity.Name != user name of the user page they are trying to edit
c) Identity.UserType() != UserType.Administrator // This is like a Role, without using RoleProviders.

I'm assuming u can decorate a controller or a controller's action method with something(s), but i'm just not sure what?

Answer 1

Look at the AuthorizeAttribute.

ASP.Net MVC: Can the AuthorizeAttribute be overriden?

Answer 2

A custom attribute derived from AuthorizeAttribute is what I use to do this. Override the OnAuthorize method and implement your own logic.

public class OnlyUserAuthorizedAttribute : AuthorizeAttribute
{
    public override void OnAuthorize( AuthorizationContext filterContext )
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            filterContext.Result = new HttpUnauthorizeResult();
        }
        ...
    }
}