ASP.NET MVC安全性 - 您应该在哪一层检查用户是否有权查看实体？

Question

I have a multi-layer (but not multi-tier) ASP.NET application that needs to check if the logged in user is authorized to view/edit an entity. I can think of several implementations:

a) Check if the user is authorized to view/edit an entity in the UI with an ActionFilter

b) Check if the user is authorized to view/edity an entity in the ServiceLayer using AOP

c) Do both?

If you don't agree with a), b) or c), where in the layers of my software application do you think I should be checking for user authorization?

Answer 1

In my personal experience, on a broader level, I found a need to do both (c). I've had to validate permissions in the action, as well as in the service layer. For this specific scenario, it may make sense to have an action filter call your service layer, or check the permissions first and don't render the view/edit capability altogether.

You're essentially talking about granular permissions; I don't know what you are using your data store for this. Make sure you plan for efficiency/performance with whatever approach you take.

Answer 2

validating if the user can see the entity is too broad? what if the user can only interact with specific aspects of the entity, but not others?

I tend to view security as "can the user perform the requested process/action". That process may interact with 1 or more entities.

therefore I tend to authenticate a user and/or validate a context specific view models via an action filter. If the execution reaches the controller action you can assume the happy path. all other validation/authentication would have already occurred and bypassed the action if there was a problem.

Answer 3

you can put [Authorize] on top of controller that you want to authorize on top of web layer, for example : you have an action : add you have a controller:area

[Authorize]
    public class areaController : Controller
    {



        public ActionResult add()
        {

            return View();
        }

in this example while not logon cant add an area