0

I came across and programming issue in my MVC app where I need to provide field-level security for some of my forms. So I need to display or hide fields on the form, based on the user's permissions. Additionally, I need to validate on post to see if the user can edit a field or add a new record.

The only solution I could come up with, was creating a HTML helper for the form and some code to walk over the fields posted to see if the user has permissions, but it doesn't seem right. How would you handle something like this? Maybe I am asking the wrong question, but there doesn't seem to be any real examples out there to look at.

How might you go about solving something like this?

closed as too broad by Scant Roger, user22815, user40980 Dec 2 '15 at 19:07

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Why the -1? No one ever explains, just leaves the negative vote. Unless I read something wrong, I thought these were the types of questions I could ask here. – Wade73 Nov 29 '15 at 12:10
2

Do not render fields for which the user doesn't have permission. The easiest way I can think of to do this is to use a partial view for those fields that require special permissions.

Remember, if you are accepting form data from the user, you still have to validate that data on the server, even for those fields that you aren't rendering, since it's still possible to inject those fields into the page before posting.

Further Reading
MVC4 Model Field Custom Authorization
Don’t Do Role-Based Authorization Checks; Do Activity-Based Checks
Disable some fields based on a user's permissions

Not the answer you're looking for? Browse other questions tagged or ask your own question.