CODEWITHSUNDEEP
c#asp.net-mvcmodel-view-controller
user1220497
user1220497

Reputation: 311

Restrict users accessing other users' data

I'm having a problem of designing a common functionality of hiding information created by a user from other users. As an example,to edit Products created by USER1, normally we use one of following.

  1. /Product/Edit/Id/1
  2. /Product/Edit?Id=1

enter image description here

My concern is, if USER2 got the Id, 1, he also able to access Product with Id=1, which was created by USER1. How to restrict USER2 accessing USER1'S data? This may needs to apply for every module in the project. Is there a common way to achieve this? Thanks

Upvotes: 0

Views: 1081

Answers (2)

DTul
DTul

Reputation: 679

If you are keeping state of what user is accessing the data. You can add a "WHERE CreatedBy = {YOURLOGGEDINUSER}" to this query and throughout your application. Then even if he gets the ID correct no data would be returned.

Upvotes: 2

ste-fu
ste-fu

Reputation: 7434

Assuming that you have enabled some sort of ASP.Net Authentication (The user has proved who they are) then you now need to think about the Authorization (what the user is allowed to do).

It doesn't help that these two terms are often combined or used interchangeably. In MVC a custom AuthorizeAttribute is often used to do both.

For managing records, the current logged on user is accessed via the IPrincipal from HttpContext.Current.User.

The user id is usually set at HttpContext.User.Current.Identity.Name although you may need to do a null check if not every route is authenticated.

Upvotes: 1

Related Questions