Question

In my view I disable or enable links as below. Even if the link “Insured or Owner Name Change” is disabled in the view I am able to access it through the url like “http://localhost:0000/NameChangeRequest?contract=111111” which should not be happening. Can anyone help me on this?

           @if (Model.CanCreateNameChangeRequest)
                    {
                        @Html.ActionLink("Insured or Owner Name Change", "Index", "NameChangeRequest", new { @contract = Model.ContractNumber }, new { @class = "requestLink" });
                    }
                    else
                    {
                        <span class="requestLinkDisabled">Insured or Owner Name Change</span>
                    }

Answer 1

You should never use Views to handle access control or any nature of business logic really. The View should only have presentation layer logic and markup.

That said, you can do this in the “NameChangeRequestController” -> “Index” action:

public ActionResult Index()
{
    if(!Model.CanCreateNameChangeRequest)
        RedirectToAction("Index","Home");
}

Also, this looks a lot like Role based permissions, in which case you should use the “[Authorize]” attribute along with “IsInRole”.