Question

What is the best way to control user access to a controller. I have local User object with a property(boolean – “IsSubscribed”). Users can only access the controller if the value is true.

Notes:

I use forms authentication, but NO .net membership/profile etc.

mvc version 2

Answer 1

You could write a custom Authroize attribute:

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var isAuthorized = base.AuthorizeCore(httpContext);
        if (isAuthorized)
        {
            // Perform your custom authorization and return true/false
        }
        return isAuthorized;
    }
}

and then decorate your controller/actions with this attribute.