c# - How to separate authorization logic from controller action? -

given following code:

public class backupscontroller : apicontroller {     private readonly iapicontext context;     private readonly ibackupservice backupservice;      public backupscontroller(iapicontext context, ibackupservice backupservice)     {         this.context = context;         this.backupservice = backupservice;     }      public httpresponsemessage get(guid id)     {         if (id == guid.empty)         {             throw new httpresponseexception(httpstatuscode.badrequest);         }          ibackupview backup = backupservice.get(id);          if (backup == null)         {             return request.createerrorresponse(httpstatuscode.notfound, string.format("backupid '{0}' not found.", id));         }          if (!isauthorizedforbackup(backup))         {             throw new httpresponseexception(httpstatuscode.forbidden);         }          return request.createresponse(httpstatuscode.ok, backup);     }      private bool isauthorizedforbackup(ibackupview backup)     {         if (context.principal.isinrole(membershiprole.admin))         {             return true;         }          if (context.principal.allowdatasharing && backup.userid == context.principal.userid)         {             return true;         }          if (backup.userid == context.principal.userid && backup.device.uuid == context.deviceuuid)         {             return true;         }          return false;     } } 

does make sense extract of method body authorization filter? don't see way without retrieving backup twice.

how go separating authorization concerns controller action?

in order separate security logic controller logic prefer use http headers carry security tokens between browser , controller , check header value in custom authorizeattribute

for example;

in beforesend function of jquery's ajax function set security token (which taken server, see below)

beforesend: function (xhr) {     xhr.setrequestheader('requesttoken', model.requesttoken); } 

check token in custom authorizeattribute

public class authattribute : authorizeattribute {     public override void onauthorization(httpactioncontext actioncontext)     {         var token = httpcontext.current.request.headers["requesttoken"];         // authorization based on token     } } 

decorate controller, actions require authorization, custom [auth] attribute, like:

[auth] public class somecontroller : apicontroller 

we can send new token client again using http headers

httpcontext.current.response.headers["requesttoken"] = guid.newguid(); 

and @ client-side can store in success function of jquery's ajax function sending in request

success: function (res, status, xhr) {     model.requesttoken = xhr.getresponseheader('requesttoken'); } 

this may not handle situation main idea carrying (preferably encrypted) security data in http headers , dealing security things in custom authorizeattribute