CODEWITHSUNDEEP
asp.net-mvcasp.net-mvc-3
Ron
Ron

Reputation: 1731

Stacking Authorization in MVC3 Controller

Is it possible to stack several custom AuthorizeAttribute on a controller?

I tried doing something like this:

[IsOwner]
[IsFranchisee]
public class CartController : Controller
{
    ...
}

but it's behavior is erratic. Sometimes it works, sometimes it doesn't (mostly the latter).

Upvotes: 0

Views: 169

Answers (3)

Ron Sijm
Ron Sijm

Reputation: 8758

Are you sure your implementation is correct? I'm asking because there is no guaranteed order with FilterAttributes, (which AuthorizeAttribute derives from) unless you set the Order property.

Because you said the behavior is erratic, I was thinking maybe one attribute cancels the other out. For example your user IsOwner == true, but IsFranchisee == false. Maybe whether or not permission is granted depends on which executes first?

So, you could try giving your attributes an order property and see if the behavior is still erratic

Upvotes: 1

Travis J
Travis J

Reputation: 82297

Usually for dynamic authorization, the controller or action is given a single [Authorize] annotation and then inside the controller or action the authorization is handled.

Upvotes: 1

Yuriy Faktorovich
Yuriy Faktorovich

Reputation: 68707

Yes you can. If you like at the source for the AuthorizeAttribute, it has AllowMultiple = true.

Upvotes: 3

Related Questions