Dynamic security for ASP.NET MVC

Question

I'm designing an app in ASP.NET MVC, and the usual way to protect actions is by the attribute Authorize which protects an entire action.

[Authorize(Roles = "Managers")]
public AtionResult Info(int employeeId )

However, in our design the application is highly data driven. An action on one set of data might be allowed, and on another set of data not be allowed.

//OK
http://host/Employee/Info/102

//Not OK
http://host/Employee/Info/105

What pattern should we use for security for this design?

Answer 1

You can create a derived Authorize attribute to do whatever you want.

public class DynamicSecurity : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        //go to db
        return true;
    }
}