Help on how to use Attribute with custom classes

Jonathas Sucupira

Hello,

I was wanting to use an attribute in some of my class methods that would make sure that the user is an authorized before using the method that they called.I was wanting to do something like
[Authorized()]
public void updateSomething()
{
//TODO:
}
Here is my attribute class

[
class AuthorizedAttribute : Attribute
{

public bool IsAuthorized { get; set; }

public string UserName { get; set; }

public string Password { get; set; }

public string UserEmail { get; set; }

public AuthorizedAttribute()
{
//This is not the actual implementation
this.IsAuthorized = false;
}

public AuthorizedAttribute(string userEmail, string userPassword)
{
this.UserEmail = userEmail;
this.Password = userPassword;
this.UserName = string.Empty;

BusinessLogic bc = new BusinessLogic();
if (bc.VerifyCredentials(userEmail, userPassword))
{
this.IsAuthorized = true;
}
else
{
this.IsAuthorized = false;
}
}
}
Could someone point me in the right direction? Some link would be great as well.
Thank you.

3 Replies

Know the answer? Post it — somebody with the same question will find it here.

Vulpes15y ago
Accepted answer
Although ASP.NET MVC has an AuthorizeAttribute class (see http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute.aspx), it's difficult to see how you could plug into this for more general use.

Unless someone has a better idea, I'd suggest something like the following for preventing users calling methods when they're not authorized to do so:

using System;

public class AuthorizedAttribute : Attribute
{
}

public class NotAuthorizedException : Exception
{
public NotAuthorizedException(string message): base(message)
{
}
}

public class MyClass
{
private readonly bool _isAuthorized;
private readonly string _userName;

public bool IsAuthorized
{
get{ return _isAuthorized; }
}

public MyClass(string userName, string password, string userEmail)
{
_userName = userName;
BusinessLogic bc = new BusinessLogic();
_isAuthorized = bc.VerifyCredentials(userEmail, password);
}

[Authorized]
public void UpdateSomething()
{
if(!_isAuthorized)
{
throw new NotAuthorizedException(_userName + " is not authorized to call MyClass.UpdateSomething");
}
Console.WriteLine(_userName + " is updating something ...");
}

public void UpdateSomethingElse()
{
Console.WriteLine(_userName + " is updating something else ...");
}
}

public class BusinessLogic
{
public bool VerifyCredentials(string userEmail, string password)
{
return userEmail == "[email protected]" && password == "whatever123";
}
}

static class Program
{
static void Main()
{
MyClass mc = new MyClass("Jonathas", "whatever123", "[email protected]");
mc.UpdateSomething();
mc.UpdateSomethingElse();
Console.WriteLine();

MyClass mc2 = new MyClass("Vulpes", "whatever456", "[email protected]");
try
{
mc2.UpdateSomething();
}
catch(Exception ex)
{
Console.WriteLine(ex.Message);
}
mc2.UpdateSomethingElse();

Console.ReadKey();
}
}

The output should be:

Jonathas is updating something ...
Jonathas is updating something else ...

Vulpes is not authorized to call MyClass.UpdateSomething
Vulpes is updating something else ...
shams khan15y ago
great work
Jonathas Sucupira15y ago
Thank you for the reply, I saw the attribute been used in MVC, but I did not know it was specific to it. I believe they have something similar with with membership Providers as well.