Question

Is there an annotation/attribute which can be set on a controller method, to have that controller action require a specific key in my session to be set?

I’m looking for a way (other than forms authentication) to do some kind of smart authorization.

Answer 1

You could extend ActionFilterAttribute in your own class and override the OnActionExecuting method. This method will get fired before entering the action:

public class RequireSessionSet : ActionFilterAttribute {
  public override void OnActionExecuting(ActinExecutingContext filterContext) {
    if (filterContext.HttpContext.Session["Foo"] == null) {
        // Redirect or do something.
    }
  }
}

Then you can annotate any action:

[RequireSessionSet]
public ActionResult Index() {
}

Edit:

You can also get fancier and allow a property to be set in the attribute:

public class RequireSessionSet : ActionFilterAttribute {
  public string SessionKey { get; set; }

  public override void OnActionExecuting(ActinExecutingContext filterContext) {
    if (string.IsNullOrWhiteSpace(SessionKey)) {
      SessionKey = "Default";

    if (filterContext.HttpContext.Session[SessionKey] == null) {
        // Redirect or do something.
    }
  }
}

[RequireSessionSet(SessionKey="SpecialKey")]
public ActionResult Index() {
}