PrincipalPermission on PageLoad

Question

I'm a newbie about the usage of Asp.NET membership capabilities and I want to know if it could be a good practice to deny the access of a whole page using code like this:

public partial class AdminPage : Page
{
   [PrincipalPermission(SecurityAction.Demand, Role = "Administrators")]
   protected void Page_Load(object sender, EventArgs e)
   {
      ...
   }
}

I suspect that it is not a good way to do things, but I would like to know why !

Thanks.

Answer 1

I think you will need a base class for all your pages, e.g.:

public abstract class BasePage : Page
{
    // Note:
    // 1. check on init, not on load
    // 2. override protected method, not handle event
    protected override OnInit(EventArgs e)
    {
        // check permissions here
    }
}

Answer 2

Small point-- put the attribute on the class. This will cause the page to raise a Security Exception as soon as you navigate to it without appropriate rights. To keep users from viewing this page, check their credentials before displaying the URL. The attribute on the class is the strong guarantee that no ordinary user will run so much as a line of the code in that class.

Yes, this is a good technique for these reasons:

The attribute works when the thread principle and the HttpContext User object are set, with a suitable IPrincipal and IIdentity. (All this would happen in the Request Authentication event in global asax) These interfaces are defined by Microsoft, well documented and available in any context, any application that runs on a MS Operating system. So any half competent developer you grab off the street could be familiar with this before they start to read your code.

Also, since Thread's IPrincipal and IIdentity are used by Microsoft (it could have been any large company with a large user base), it's battle tested code. You can still do something stupid, but the existing patterns are there to help you fall into the pit of success.

On the other hand, if you are putting a custom object into Session, a magic cookie or some other token, then the maintenance developer will have to learn how it works from scratch and then review it to see if has exploitable vulnerabilities.