5
Shouts

Securing your ASP.NET MVC 3 Application - Rick Anderson

published 752 days, 19 hours, 7 minutes ago posted by DustinDustin 753 days, 17 hours, 22 minutes ago
Wednesday, May 04, 2011 12:54:12 PM GMT Tuesday, May 03, 2011 2:39:17 PM GMT

In ASP.NET MVC 2 it was recommended that you create a base controller with an [Authorize] attribute, and derive each controller (except the Account/Login controller) from that base class. That strategy has one big flaw, nothing prevents you from adding a new controller that doesn't derive from the [Authorize] protected base controller. Another approach for ASP.NET MVC 2 was to apply the AuthorizeAttribute to just the specific controllers or actions that need to be secured. The flaw with selectively applying the AuthorizeAttribute; it's easy to forget to add the AuthorizeAttribute to to new controllers or action methods...

category: Web Dev | clicked: 17 | | source: blogs.msdn.com | show counter code
tags: ASP.NET MVC 3, ASP.NET MVC, Security, MVC, ASP.NET

1 comment posted.

To post your comment please login or signup