Question

Are there any possible security issues or pitfalls to, within a custom AuthorizeAttibute (registered globally), apply authorization based on the controller type and action being called?

e.g. (not real code)

string controllerFullName=_filterContext.ActionDescriptor.ControllerDescriptor.ControllerType.FullName;

string minRequiredRole = GetControllerMinRequiredRole(controllerFullName);

if(User.MeetsRoleRequirement(minRequiredRole))
{
     //give access
}
else
{
    //no you're not allowed
}

Answer 1

The main issue is with Authorization caching – so there are a few things to know. Check out the links I’ve posted here:

Creating a AuthorizeAttribute – what do I need to know?

Look at the code to the existing attribute and how it handles caching to ensure you arent causing the same issue the base attribute prevents.