Question

I am currently working on an ASP.NET MVC2 application and would just like to know the best way of achieving the following:

Each user that logs into the site pays membership fee which lasts X amount of days. I record the membership payments and the expiry dates in the database.

I would like all users to be able to login even if their membership has expired. However certain Controllers/Actions will be out of bounds to members whose membership have expired.

So my question is what is the best way to redirect users who try to access these pages when their membership has expired?

I don’t really want to be calling a method that checks the membership status from each action where I don’t want expired members to have access (although if this is the only way I would have to).

I thought about a custom ViewPage that inherits from System.Web.Mvc.ViewPage which I would override the OnInit function and check the membership status and redirect if necessary.

Could anyone give me their thoughts on the above or let me know if there is a better and more maintainable solution?

Answer 1

Secure controllers or action methods that require membership with the [Authorize] attribute and a custom role:

[Authorize(Roles="ActiveMembership")]
public ActionResult SomeMembershipContent()
{
}

Secure controllers or action methods that simply require with the [Authorize] attribute and no role:

[Authorize()]
public ActionResult SomeSimpleContent()
{
}

Then in whatever membership provider or custom login solution you use give the user an additional role if they are a paying member.