Question

I’m creating an ASP.NET MVC4 application which has a left menu panel, and the right main panel will be the content panel. (@RenderBody)

The links on the menu are generated based on the login role of the user. E.g., users with higher access will see more links on the menu. These access rights are stored in the database.

I have a _Layout.cshtml page which all my pages inherit from.

How should I code my access menu such that the access is retrieved only from the database once, during login? There after, every page the user navigates to, I won’t have to re-query the database for his access rights.

Should I use Html.RenderAction or Html.Partial for my access menu page?

Answer 1

I’d say the easiest way to do this is to use MVCSiteMapProvider which you can add to your project using NuGet.

It has an option securityTrimmingEnabled which will automatically remove items the user isn’t authorized to see from the site map and hence from the menu.

How should I code my access menu such that the access is retrieved only from the database once, during login?

You should get your roles using a RoleProvider. If you have your own database schema for roles, you may need to write a custom role provider. The custom role provider can implement caching to avoid hitting the database too often, or, as long as there aren’t too many roles, you can use the CacheRolesInCookie property.

Then put an Authorize attribute on Controllers and Actions that should be secured:

[Authorize(Roles="SomeRole")]
public ActionResult MyAction()
{
    ...
}