Question

For certain actions like changing email settings or administrator activities, I want users to re-authenticate before the action is completed. Is there a good pattern for doing this in ASP.NET MVC 3?

Answer 1

Descpription

You can create your ActionMethod with Username, Password and the field you want to change (Email) for example. Than validate this data in the [HttpPost] of your data. If the authorization has success, change it and if not add the error to the ModelState.

Use a ViewModel for that.

Sample

public class ChangeEmailViewModel
{
    public string Username { get; set; }
    public string Password { get; set; }
    public string EmailAddress { get; set; }
}


public ActionResult ChangeEmail()
{
    return this.View(new ChangeEmailViewModel());
}

public Action ChangeEmail(ChangeEmailViewModel model)
{
    // authorize
    bool isAuthorized = // your logic.
    if (isAuthorized)
    {
        // change email
    } else
    {
        ModelState.AddModelError("Username", "Username is not valid");
    }

    return this.View(model);
}