One thing I’ve noticed in AuthorizeAttribute there is no access to the RedirectToAction or RenderView methods. These methods are protected by the Controller class and therefore unaccessible under the filterContext.Controller.In my mind I can find several valid reasons why I would want to add an attribute and then possibly short circuit the action with another Redirect or Render. The only way I’ve found to get around this is to create my own base controller.
public class myAuthorizeAttribute : AuthorizeAttribute
{
public string Modules
{
get;
set;
}
public string Privileges
{
get;
set;
}
///——————————————————————————————–
///
/// Called when a process requests authorization.
///
///The Filter context, which encapsulates information for using . /// The parameter is null.
public override void OnAuthorization(AuthorizationContext filterContext)
{
base.OnAuthorization(filterContext);
if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
{
RedirectToAction(filterContext, “AccessDenied”, “User”);
}
// Developers have access to everything, so don’t bother loading permissions
if(MvcApplication.UserIsDeveloper)
{
return;
}
}
///——————————————————————————————–
///
/// Redirects to action.
///
///The filter context. ///The response code. ///Name of the action. public void RedirectToAction(ControllerContext filterContext, string actionName)
{
if(String.IsNullOrEmpty(actionName))
throw new ArgumentNullException(“actionName”);
RouteValueDictionary values = new RouteValueDictionary();
values.Add(“action”, actionName);
RedirectToAction(filterContext, values);
}
///——————————————————————————————–
///
/// Redirects to action.
///
///The filter context. ///The response code. ///Name of the action. ///Name of the controller. public void RedirectToAction(ControllerContext filterContext, string actionName, string controllerName)
{
if(String.IsNullOrEmpty(actionName))
throw new ArgumentNullException(“actionName”);
if(String.IsNullOrEmpty(controllerName))
throw new ArgumentNullException(“controllerName”);
RouteValueDictionary values = new RouteValueDictionary();
values.Add(“action”, actionName);
values.Add(“controller”, controllerName);
RedirectToAction(filterContext, values);
}
///——————————————————————————————–
///
/// Redirects to action.
///
///The filter context. ///The response code. ///The values. public void RedirectToAction(ControllerContext filterContext, RouteValueDictionary values)
{
VirtualPathData virtualPath = RouteTable.Routes.GetVirtualPath(filterContext.RequestContext, values);
string url = null;
if(virtualPath != null)
url = virtualPath.VirtualPath;
filterContext.HttpContext.Response.Redirect(url);
}
}
ref: http://forums.asp.net/t/1239842.aspx/1