CODEWITHSUNDEEP
asp.net-mvc-3securityaction
Achilles
Achilles

Reputation: 1734

Is it possible to deny access via URL to a PartialViewResult action

I'm trying to deny access to an action returning PartialViewResult; but it seems to be impossible. If I tag the action method with NonAction attribute, the page won't render and if I don't, it's possible to get that partial view using a URL.
Suppose I have this in _Layout.cshtml: 

<section role="navigation">
    @Html.Partial("PageParts/Sidebar")
    @RenderSection("SidebarContents", required: false)
</section>

and this is PageParts/Sidebar.cshtml:

@Html.Partial("PageParts/Sidebar/Userinfo")
@{Html.RenderAction("getNavigation", "PageSemantics");}

and this is PageSemanticsController.cs:

public class PageSemanticsController : Controller {

    public PartialViewResult getNavigation() {
        NavigationModel nm = new NavigationModel();
        return PartialView("PageParts/Sidebar/Navigation", nm);
    }
}

and finally this is ~/Views/Shared/PageParts/Sidebar/Navigation.cshtml:

@model NavigationModel
<nav id="main-nav">
    [... Some code to create Navigation ...]
</nav>

This setup works fine, except ~/PageSemantics/getNavigation is accessible via URL. Is there any way to deny access to getNavigation action via URL while keeping this setup working?

Upvotes: 1

Views: 732

Answers (1)

Rapha&#235;l Althaus
Rapha&#235;l Althaus

Reputation: 60503

try to put attribute

[ChildActionOnly]

on your getNavigation() method

Upvotes: 5

Related Questions