Question

Hi,

I got a ASP.NET MVC website where end users can create account. I do however need them to grant a agreement first time thay login and if not, then thay should not be able to get to any other webpage on this site while thay are logedin.

Is this possible, and if so how?

Answer 1

An easy way would be creating a custom authorize attribute. The below authorize attribute checks if the user is authenticated and authorized and if yes the you have make db call to know if the user is confirmed and return false if not setting a private variable isNotConfirmed to true.

In the HandleUnauthorizedRequest you have to check why the auth. failed and if it i due to not confirmed then you can redirect the user to a confirm page.

public class CustomAuthorize : AuthorizeAttribute
  {
    bool isNotConfirmed = false;

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {      
      if (base.AuthorizeCore(httpContext))
      {
        //if the user is not confirmed set isNotConfirmed true and return false;
        isNotConfirmed = true;

        // else return true;
      }

      return false;
    }

    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
      if (isNotConfirmed)
      {
        filterContext.Result = new RedirectResult("/Confirm");
      }
      else
      {
        base.HandleUnauthorizedRequest(filterContext);
      }
    }
  }