I call this action method using an ajax call:
[AuthorizeCheckCreator]
[HttpPost]
[OutputCache(Location = OutputCacheLocation.None, NoStore = true)]
public ActionResult Delete(Guid id)
{
// code....
return Content("ok");
}
I have created a custom AuthorizeAttribute for checking permission of the user (I wanted to make sure whether the user is owner the record or not):
public class AuthorizeCheckCreatorAttribute : AuthorizeAttribute
{
public IRequest RequestService { get; set; }
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
RequestCheckUserViewModel request;
if (httpContext.Request.IsAjaxRequest())
{
var ajaxId = JsonConvert.DeserializeObject<GetId>(System.Text.Encoding.UTF8
.GetString(httpContext.Request.BinaryRead(httpContext.Request.ContentLength)));
var currentId = ajaxId.Id;
var isAuthorized = base.AuthorizeCore(httpContext);
if (!isAuthorized) return false;
requestBank = RequestService.GetUserId(Guid.Parse(currentId));
}
else
{
var rd = httpContext.Request.RequestContext.RouteData;
var currentId = rd.GetRequiredString("id");
var isAuthorized = base.AuthorizeCore(httpContext);
if (!isAuthorized) return false;
requestBank = RequestService.GetUserId(Guid.Parse(currentId));
}
var result = httpContext.User.Identity.GetUserId<int>() == request.UserId ||
httpContext.User.IsInRole("Admin") ||
httpContext.User.IsInRole("BankResponsible") ||
httpContext.User.IsInRole("BankManager");
return result;
}
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
// handling the unauthorized requests
}
}
public class GetId
{
public string Id { get; set; }
}
With this code in place I always get null value for id parameter. I'm sure the client side code works fine becuase when I remove [AuthorizeCheckCreator] from Delete action method, I get value of id.
Any idea?
