Question

I’m trying to deny access to an action returning PartialViewResult; but it seems to be impossible. If I tag the action method with NonAction attribute, the page won’t render and if I don’t, it’s possible to get that partial view using a URL.
Suppose I have this in _Layout.cshtml:

<section role="navigation">
    @Html.Partial("PageParts/Sidebar")
    @RenderSection("SidebarContents", required: false)
</section>

and this is PageParts/Sidebar.cshtml:

@Html.Partial("PageParts/Sidebar/Userinfo")
@{Html.RenderAction("getNavigation", "PageSemantics");}

and this is PageSemanticsController.cs:

public class PageSemanticsController : Controller {

    public PartialViewResult getNavigation() {
        NavigationModel nm = new NavigationModel();
        return PartialView("PageParts/Sidebar/Navigation", nm);
    }
}

and finally this is ~/Views/Shared/PageParts/Sidebar/Navigation.cshtml:

@model NavigationModel
<nav id="main-nav">
    [... Some code to create Navigation ...]
</nav>

---

This setup works fine, except ~/PageSemantics/getNavigation is accessible via URL.
Is there any way to deny access to getNavigation action via URL while keeping this setup working?

Answer 1

try to put attribute

[ChildActionOnly]

on your getNavigation() method