This is a migrated thread and some comments may be shown as answers.

custom AuthorizeAttribute causing menu items to be hidden

13 Answers 261 Views

This is a migrated thread and some comments may be shown as answers.

This question is locked. New answers and comments are not allowed.

Patrick Barranis asked on 05 Mar 2010, 03:40 PM

Hi. I've implemented a custom authorization attribute that inherits AuthorizeAttribute. When I use the AuthorizeAttribute on an Action in my controller, if I reference the same action in my Telerik Menu it appears fine on the website.

However, if I use my custom attribute (source code below), on either the Controller definition (at the top) or on the Action method itself then the item disappears from my menu.

I never would have expected the Telerik Menus to automatically try to check AuthorizeAttributes and hide items dynamically - I love it! This is a great feature, but unfortunately it's not working for me. Here's the source from my custom attribute:

                    Public Class MutiSiteAuthorizeAttribute         
                Inherits AuthorizeAttribute         
                     
                Private _rightNeeded As Rights = Rights.LoginToWebsite         
                     
                Public Sub New(ByVal right As Rights)         
                    _rightNeeded = right         
                End Sub         
                     
                Protected Overrides Function AuthorizeCore(ByVal httpContext As System.Web.HttpContextBase) As Boolean         
                     
                    If Not httpContext.User.Identity.IsAuthenticated Then         
                        Return False         
                    End If         
                     
                    Return BLL.Roles.UserCan(_rightNeeded, httpContext.User)         
                End Function         
            End Class         

I'm running Telerik MVC 2010.1.218.235, Microsoft MVC 2 RC2 on VS 2008SP1 (On Win7 Enterprise & with the ASP.NET Development Server). I'm also running on old Coke, not new Coke :)

Many thanks in advance!

13 Answers, 1 is accepted

answered on 09 Mar 2010, 01:52 PM

Hi Kazi. I'm sorry - I was a bit unclear. Based on the fact that the item disappeared I was assuming that the intended design, by Telerik, was that the item would show or hide based on the role of the user that's logged in. However, that's just an educated guess.

If the control is not designed to automatically hide items that the user doesn't have permission to access, then I would simply expect that the item in the menu is always visible. I would not have expected that the item suddenly disappear when I added the attribute.

In either case the item shouldn't have disappeared. The user logged-in has the necessary rights to perform that action, and if I type the URL manually into the browser, the action runs successfully without a security exception.

Thanks,

Patrick

answered on 10 Mar 2010, 04:07 AM

Hi Patrick Barranis,

Yes you are correct, it is designed in a way that the item will hide if the user does not have the permission.

When rendering the navigational components like menu/tree/panelbar/tab we check whether the associated action does have the permission. The Action or Controller are decorated with Authorize attribute so typing directly to that Url willl result same security exception.

All the best,
Kazi Manzur Rashid
the Telerik team

Do you want to have your say when we set our development plans? Do you want to know when a feature you care about is added or when a bug fixed? Explore the Telerik Public Issue Tracking system and vote to affect the priority of the items.

answered on 12 Mar 2010, 05:17 PM

I was wrong... it doesn't work fine if I make a default, empty constructor. Only the default constructor gets called, so whatever I return for that default case is what always gets returned.

Here's the sample attribute I made to test in an empty project:

                    Public Class MutiSiteAuthorizeAttribute         
                Inherits AuthorizeAttribute         
                     
                Private val As String         
                     
                Public Sub New()         
                    val = "qwerty"         
                End Sub         
                     
                Public Sub New(ByVal right As String)         
                    val = right         
                End Sub         
                     
                Protected Overrides Function AuthorizeCore(ByVal httpContext As System.Web.HttpContextBase) As Boolean         
                    Return val = "asdf"         
                End Function         
            End Class         

As you can see, it's designed to fail if the default constructor is called. If, however, the "normal" constructor is called with "asdf" it will return True.

And here's how I decorated the Home -> About action in a completely empty, default MVC project:

                        <MutiSiteAuthorize("asdf")> _         
                Function About() As ActionResult         
                    Return View()         
                End Function         

The Telerik Menu I placed on the page never shows the "About" menu item. If I set breakpoints, the default constructor is the only one that gets called (ever). Yes if I type in the url http://localhost/Home/About, the page renders fine.

I've tested my real website similarly and I get exactly the same results. I have even checked that if I'm logged in under a user that shouldn't get to some pages I can type in the URL manually and I get kicked to the login page, but if I'm logged in under a user that can get to any page then typing in the URL works fine.

Let me know if you want my copy of this test project, however, all my changes are in the code blocks above.

Thanks,

Patrick

answered on 16 Nov 2011, 04:27 PM

MVCAuthorized.zip

Hello Faisal,

I have attached a simple test project, which shows how the required task is accomplished.

Regards,
Georgi Krustev
the Telerik team

If you want to get updates on new releases, tips and tricks and sneak peeks at our product labs directly from the developers working on the Telerik Extensions for ASP.MET MVC, subscribe to their blog feed now