Security Attributes

Question

A friend asked me how to give more security in your application, to avoid a kind of "url injection", IE, someone manually type an "addicted" url and bypass the system. Of course, there are several types of encryption that could help, but the injection could bypass.

I once saw an example and I think it was here in Sopt (I’m not sure), someone talking to create a security attribute that would always validate the class he has the need not to allow the "intruder". I searched for "Attribute" and "Create attribute" or "Attribute Creation" and I couldn’t find anything, not what I was looking for and nothing like that.

So I ask, how do I create an attribute that always validates the user and password, without always asking that of the user, that is, as the user enters certain files, the attribute already validates this user invisibly and if you had no right of access, then we treat here?

But how to create the attribute itself, I see no problems, the question is to create an attribute that validates the user, I am not able to do.

Answer 1

For both ASP.NET MVC and Web API, we are talking about AuthorizeAttribute.

The questions I’ve already answered are here.

Basically this is what he does: by entering a Controller or Action that has this attribute marked, the system does a user validation, redirecting to a login screen if this is necessary.