Question

I need authorization attribute to ensure that authenticated user can access in secure area to manage his and only his data.

I was thinking to retrieve httpContext.User.Identity.Name and to match that to retrieved username from the database.

Is this basically good (secure) approach? or it can be done with better secure on the mind?

So, my controller is decorated with custom attribute

[UserAccountAuthorizeAttribute]
public ActionResult Edit(string username)
{
    return View();
}

and I’m overriding AuthorizeAttribute but in the debug mode got null value on following line

var rd = httpContext.Request.RequestContext.RouteData;
var username = rd.Values["username"]; // null

what can be aproblem ?

Answer 1

You shouldn’t be putting the username in the querystring.

If you’re using the built in ASP.NET Membership provider your action would look something like this.

    [Authorize]
    public ActionResult Edit()
    {
        var userId = (Guid)Membership.GetUser().ProviderUserKey;

        var someService = new MyService();
        var someData = someService.GetSomeDataByUserId(userId);
        //...
    }