Skip to content
This repository has been archived by the owner on Dec 9, 2022. It is now read-only.

Inherit AuthorizeAttribute so 3rd parties can identify FluentSecurity as an authorization component #73

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

NightOwl888
Copy link

As mentioned in #72, MvcSiteMapProvider can automatically pick up the authorization settings from FluentSecurity if it inherits AuthorizeAttribute.

Per this post, there are many built-in types in the MVC framework (and potentially by 3rd parties) that implement IAuthorizationFilter (including Controller), and most of these types do not provide any authorization capability. The only positive way to identify that a component is for MVC authorization is if it inherits AuthorizeAttribute. Since that is exactly what FluentSecurity does, it should inherit AuthorizeAttribute.

Although, admittedly on your side of the fence this looks a little like a hack because of the hidden properties, this fix creates the ideal scenario.

  1. If you install FluentSecurity, it will work.
  2. If you install MvcSiteMapProvider, it will work.
  3. If you install FluentSecurity and MvcSiteMapProvider, they will automatically interact.
  4. There are no dependencies required between the two libraries.
  5. There are no special cases in either library.
  6. There is no special configuration required for either library to make them interact.
  7. Other 3rd party components can potentially pick up FluentSecurity automatically, as well.

Do note that I put the property hiding in a separate commit in case you want to do it another way. Also note that the Order, Roles, and Users properties are only hidden if you access the library from another solution, but they are visible within the FluentSecuirty solution. If desired, you could also hide the protected members of AuthorizeAttribute so they aren't visible to inheritors of HandleSecurityAttribute.

This change is completely backward compatible with the current implementation.

I tested it with MvcSiteMapProvider and it is working. I also verified the build script is working.

…y libraries can identify FluentSecurity as an MVC security component without making a special case.
…uthorizeAttribute so they cannot be seen or misused.
@kristofferahl
Copy link
Owner

Thanks for the pull-request. I've added some comment about this to the original issue (#72: Why doesn't HandleSecurityAttribute inherit AuthorizeAttribute?)

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants