Question

I have an MVC3 application that uses the standard accountcontroller that comes with visual studio to authenticate users.

I want to share specific parts of my program with people, much like google shares documents in google docs when you do that via email; in other words I don’t want to give anyone access to the pages (In which case I could just remove the Authorize attributes) but I do want users to share pages based on a url with a hash in it, and have them skip the login.

I think I would like to generate the hash based on a page and link it to an anonymous user, which would then have to be auto-logged in if the hash is correct

How would I do that?

Answer 1

1. Create a table in database with shared pages information(controller, action, documentId, hash, expiresAt, etc)
2. Override Authorize attribute and in OnAuthorizationvalidate url params in your database.

    public class SharedAuthorize:AuthorizeAttribute  
    {  
        public override void OnAuthorization(AuthorizationContext filterContext)
        {  
            var documentHash = int.Parse(filterContext.RouteData.Values["hash"].ToString());
            if (!HashRepository.CanWeRead(documentHash,controller, action, documentId))
            {
                return false;
            }
            return true;
        }
    }

This is just an idea=))