asp.net MVC表单身份验证自定义

Question

I am thinking about how to solve an authentication problem that i have.

I have a MVC-site with an admin area which is going to be used for customer-inputs and its very easy to have formsauthentication to protected the admin area but my problem is that other users could be able to edit other users stuff and thats not what i want =(.

My previous sites only handled authentication for one site and formsauthentication handled all my problems but this site should be able to handle authentication for X users and X customers.

For example user1 logs in to user1 admin area (mysite/customer1) but after log in changes the url to mysite/customer2 and starts editing stuff here.

One solution would be in global.asax and the FormsAuthentication_OnAuthenticate and check the url but there must be better approaches to this right? Maybe i am missing something obvious here?

Answer 1

What if once the user logs in (user1) you save their userId (or some unique identifier) into a claim or session. then just make one page mysite/customer which will read that Id and bring back just that one person's record. so this way the only record they will see is the one associated with their Id and you don't have to make the same pages over and over for other users, so no mysite/customer1, mysite/customer2, mysite/customer3...etc..