Question

I have the following:

[Authorize(Roles = "admin")]

I am setting it for every action on my controller. However is there some way I can do this globally for the controller?

Answer 1

[Authorize(Roles = "admin")]
public class AdminController : Controller
{
}

The attribute works on controllers too.

You can even create a base controller and set the attribute on it (and therefore get the same authorization on all derived controllers)

[Authorize(Roles = "user")]
public class BaseController : Controller
{
}

public class NewsController : BaseController 
{
}

public class ForumController : BaseController 
{
    [HttpPost, Authorize(Roles="admin")]
    public ActionResult Delete(int id)
    {
    }
}

Update

First question: You can put [HandleError] in your base controller to get MVC’s error handling in all controllers. I’ve just written a blog entry describing it.

Second question: Yes. Put the most specific [Authorize] attribute on the actions. (for instance authorize “users” in the base controller and “admins” on the Edit action).