Question

Scenario:
We have MVC 4.0 web application with display myOrders which returns json result with historical data.

This action will be called by JQUERY Ajax from front end.

Problem:
Is there anyway we can authentication and make sure that the orderID passed from JQuery Ajax front end belongs to logged in user?

Thanks heaps.

Answer 1

I usually do it in this way. Probably your Order record should have a CreatedById field where you store the ID of the user who created it. When you get the OrderID from the Ajax call in your action method, build an Order object from that ID and check what is the CreatedByID value. Compare it with the current logged in UserId( you may have it in the session ?) and the decide whether to show the page to the user.

Some thing like this.

public ActionResult GetOrder(int id)
{
  Order objOrder=OrderService.Get(id);
  if(objOrder.CreatedById==GetCurrentLoggedInUserId())
  {
    return View(objOrder);
  }
  else
  {
    return View("NotYours");
  }
}