Question

I want to make a custom AuthorizeAttribute class as described here: Override Authorize Attribute in ASP.NET MVC.

The trick is, whether or not the user is authorized depends not just on what method he is executing, but the parameter as well:

[MyCustomAuthorize(id)]
[HttpGet]
public ActionResult File(Guid id)
{

}

Basically, the user will be authorized to see some Files, but not others, so I want to pass the id to my custom authorize attribute. But I can’t seem to do this because the name ‘id’ isn’t in scope.

I know I could do the logic to make sure the user has access to that File at the beginning of the method, but I have several methods that would all need this done, and it would be much cleaner if I could do it as part of the [Authorize] attribute.

Answer 1

No, that’s not legal C#.

You can access the RouteValues inside the AuthorizeAttribute subtype, however.

Inside, e.g., OnAuthorization, you can do:

object id = filterContext.RouteData.Values["id"];

Be careful, though. You really need to know what you’re doing here. The interaction between authentication, authorization, and caching is complex.