Question

I like ASP.Net MVC Authorize attribute, I can extend it and build my own logic and decorate my controller with it. BUT,

In my architecture, I have one common service layer(C# Class Library). End user can access my application via ASP.Net MVC web site or via my exposed REST WCF Webservice layer.
My asp.net MVC application and REST WCF service layer both in turn access my common service layer.

I want authorization to happen in this common service layer and not in ASP.Net MVC Controller or in my exposed REST Service layer.

Can I create ASP.Net MVC Authorize attribute like thing to decorate my methods in the common C# class library? This attribute will take parameters and will decide if the current user has access to perform that function or not?

Thanks & Regards,
Ajay

Answer 1

What you’re looking for can be achieved using AOP library, like PostSharp (http://www.postsharp.org/). It’s more complex than using Authorize attribute in mvc, but is still quite simple.