Implementing Security Access Rights in ASP.NET Button

In Web based Application, each of the users have different privileges and access rights based on their roles. Each of these roles can have Read or Write Access for different webpages.When the user logs into the System, the button are disabled/enabled or hidden/shown based on the role of the user. Generally we have to write a lot of code to provide this kind of functionality of disabling/enabling or hiding/showing the button and that too this code has to be implemented on each of the web page.

This can be avoided by overriding the default aspx button. A property called "AccessRight" is added to the default aspx button where we can pass the type of the access for the button. The button is automatically disabled/enabled or hidden/shown based on the access right of the user and access type of the button.

In this article, I will show you how to override the default button which saves us from writing a lot of code. The code is written in C#.

The following code shows you how to override the default aspx button and add a property called "AccessRight" which defines the type of access for the button.

namespace akhilpittu // namespace
{
public class button:System.Web.UI.WebControls.Button
// button is derived from Button Class
{
/// <summary>
/// Constructor Class
/// </summary>
public button()
{}
// private variable for button Access Right
private string strbtnAccessRight = null ;
/// <summary>
/// Access Right Property
/// </summary>
public string AccessRight
{
get // get method
{
return strbtnAccessRight ;
}
set // set method
{
strbtnAccessRight = value ;
}
}
/// <summary>
/// On Prerender of the button , it is made disabled or enabled based on the Access Rights
/// </summary>
/// <param name="e"></param>
protected override void OnPreRender(EventArgs e)
{
// Enable or Disable the button on the basis of the Access Rights
string strAccessRight = null ;
// Get the Logged in User, Access Right from the Session
strAccessRight =(string) HttpContext.Current.Session["AccessRight"];
// boolEnabled Flag is defaulted to false
bool boolEnabled = false ;
if(strAccessRight != null ) // If the User Access Rights in not Null
{
switch (strAccessRight) // User Access Right
{
case "R" : // User Access Right is R
switch(strbtnAccessRight)
{
case "R" : // Button Access Right is R
boolEnabled = true ;
break ;
case "W" : // Button Access Right is W
boolEnabled = false ;
break ;
}
break ;
case "RW" : // User Access Right is W
switch(strbtnAccessRight)
{
case "R" : // Button Access Right is R
boolEnabled = true ;
break ;
case "W" : // Button Access Right is W
boolEnabled = true ;
break ;
}
break ;
}
}
// based on the Access Rights, the button is made enabled or disabled
base.Enabled = boolEnabled ;
base.OnPreRender(e);
}
}
}

Description of the Code

We are required to make one c# class or vb class which can be included in the ASP.Net project itself or the class can be compiled separately into a dll which can be referred in the ASP.Net project.

Custom Namespace used

akhilpittu: The namespace of the control which can be changed accordingly.

Public Class used

The button is defined as a public C# class, which is inherited from System.Web.UI.WebControls.Button class. The button class contains one Property called AccessRight and one Protected Method.

Property Used

AccessRight: This property is used to set the access type (Read/Write) for the button during the design mode.

Protected Methods Used

OnPreRender: This method is used to disable/enable or hide/show the button before it is rendered to the webpage.

Compilation of Class

This class is compiled using the command prompt. Command Prompt window can be
opened from Programs->Microsoft Visual Studio.Net->Visual Studio Tools ->Visual Studio.Net Command Prompt

VB class

vbc /r:System.dll,System.Web.dll /t:library /out:button.dll C:/button.vb

C# class

csc /r:System.dll,System.Web.dll /t:library /out:button.dll C:/button.cs

Switches used

/r: resource switch to include all the resources used in the class
/t: target switch conveying the compiler that it has to be compiled to a dll and not to an exe
/out: switch indicating the name of the dll

button.cs is the name of class file which is to be compiled. Here in this example, this file is contained in the C Drive but you can put this file in any folder you wish to. But you will have to give the full path of button.cs file while compiling.

Using the button Control in ASPX File

This dll has to be included in the Reference of the Web Application before it can be used in an aspx page

Registering the Control in the ASPX File

The control needs to be registered in the aspx page in which we wish to use this control using the Register directive.

<%@ Register TagPrefix="aspx" NameSpace="akhilpittu" Assembly="button"%>

TagPrefix: The name of the Tag by which we will refer this control in our asp page
NameSpace: The namespace which is used in the assembly (button.dll)
Assembly: The name of the assembly (compiled vb/cs class)

Using Control in the ASPX File

<aspx:button ID="btnSave" Runat="server" Text="Save" AccessRight="V"></aspx:button>

aspx: The TagPrefix which is defined at the time of registering the control.
button: The Public class in the dll which is used for disabling/enabling or hiding/showing the button.
AccessRight: The access type of Read/Write for the button which is to be defined at the design time.

Here we have seen how to override the default button to make it disable/enable or hide/show based on the Access Right of the user who has logged into the System thus protecting the System from any action which is not allowed for a particular user. This will certainly save your time when you get down writing code.