Dynamic security for ASP.NET MVC

I开发者_Go百科'm designing an app in ASP.NET MVC, and the usual way to protect actions is by the attribute Authorize which protects an entire action.

[Authorize(Roles = "Managers")]
public AtionResult Info(int employeeId )

However, in our design the application is highly data driven. An action on one set of data might be allowed, and on another set of data not be allowed.

//OK
http://host/Employee/Info/102

//Not OK
http://host/Employee/Info/105

What pattern should we use for security for this design?

You can create a derived Authorize attribute to do whatever you want.

public class DynamicSecurity : AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        //go to db
        return true;
    }
}

You could decorate your action methods with a custom attribute deriving from the ActionFilterAttribute class, and in the OnActionExecuting method inspect the data in the incoming request, and if anything's not allowed then throw a security exception/redirect/do whatever you require.