CODEWITHSUNDEEP
c#asp.net-mvcasp.net-mvc-4razor
Iain Bruce
Iain Bruce

Reputation: 83

Best way of sharing user specific variables around my MVC4 app

I am building an MVC4 app using razor, I have done many in the past but I want to roll some best practice in to this one in terms of dealing with variables.

The situation is that I have a logged in user (logged in meaning a windows authentication, with that user name matched to a user in my user table). That user comes with a set of profile options such as "canViewReports", "canEditPerson" etc etc.

Now, there are two prongs to those profile options. First is that my presentation layer needs to customise itself depending on what is presented to it. So profile 1 has canViewReport set to false so the tab for reports will be hidden. Profile 2 has it true so the tab will be shown.

The second prong is that if my savvy users type in /reports/index, I need to pick that up and block access for profile 1 but allow profile 2.

Ok, so at the moment I am using a base controller that is decorated with a [UserDataFilter], that user data filter calls a method that checks the current session for a set of keys and if they are missing assigns them. I put each of those profile options for the current user in to the session. I can then use the session variables in my presentation layer and also in code.

My concern is that that is messy looking in my code having to put this kind of thing everywhere: 

 (bool)session["canViewReports"] everywhere in my razor.

That lead me to try using the viewstart.cshtml and setting App variables in there that I can use in my razor a bit cleaner. In viewstart I set:

 App.canViewReports = (bool)HttpContext.Current.Session["canViewReports"];

I can then just use App.canViewreports everyhwere in my views without too much trouble.

My questions are:

1) Is App.canViewReports for the entire application at an IIS level, or does each connection to IIS get its own pool of App. variables. The thing I want to avoid is the first user setting the variable and every other user that subsequently uses the application getting that value! (on different computers)

2) Is there a better way of doing this!!!

Many thanks

Iain

Upvotes: 0

Views: 57

Answers (2)

Vlad
Vlad

Reputation: 14

You could create an ISessionService that stores the session information you need.In this way,you can implement it however you want and have full control over it.It could be retrieved easily via a DI container and it's easy to mock.

Upvotes: 0

KevDevMan
KevDevMan

Reputation: 818

I would use User.IsInRole("canViewReports") in my razor logic to hide and show the menus item. If you build you menu in you layout you only need to do this once.

I would then further protect the action method by decorating the method with [AuthorizeUser("canViewReports")]

Upvotes: 1

Related Questions