Question

In my Controller before a Model is modified (updated or deleted) I am trying to verify that the User performing the action actually owns the object they are trying to modify.

I am currently doing this at the method level and it seems a bit redundant.

[HttpPost]
public ActionResult Edit(Notebook notebook)
{
    if (notebook.UserProfileId != WebSecurity.CurrentUserId) { return HttpNotFound(); }

    if (ModelState.IsValid)
    {
        db.Entry(notebook).State = EntityState.Modified;
        db.SaveChanges();
        return RedirectToAction("Index");
    }
    return View(notebook);
}

Is there a generic way of doing this that could be reusable across various models?

Is it possible to do this with an ActionFilter?

Answer 1

I can see one problem with what you have – you are relying on user input to perform the security check.

Consider your code

if (notebook.UserProfileId != WebSecurity.CurrentUserId)

Notebook has come from model binding. So UserProfileId has come from model binding. And you can quite happily fake that – for example I use Firefox’s TamperData to change the value of the hidden UserProfileId to match my login and away I go.

What I end up doing (in a service, rather than the controller) is on a post pulling back the record from the database based on the unique id passed (Edit/2 for example would use 2), and then checking User.Identity.Name (well, the passed identity parameter) against the current owner field I have in my returned database record.

Because I pull back from the database (repository, whatever) an attribute isn’t going to work for this, and I’m not sure you could be generic enough in an attribute’s approach anyway.