I am using a details view to display information of teachers. I want that information of only that teacher is displayed who have logged in using his ID. This Id is stored in Teacher table(apart from the login table). I am using a Session variable to store the logged in Id.
Related
I'm building a simple web form which allows user to edit there data like email, emergency contact etc.
The edit form is rendered using Asp.NET MVC 5. Proper html fields are rendered for Id, email, emergency contact etc.
Lets say the request to save the data is received by the following controller method.
SaveData(recordId, email, emergencyContact)
{
;
}
Question: How do I make sure that recordId was indeed the id that was rendered as part of the edit form? We don't want this user to update another user's record.
I have the following options in mind
1. Create a hash of the record id and send the hash as well.
2. Ensure user is authorized to modify the record indicated in given record id.
Is there any other way? Does MVC 5 provide any features so that I don't have to put this sort of logic in my application logic?
Typical approaches are:
Store the ID of the record as a hidden field. If you are concerned with hijacking, encrypt the value and decrypt on the server.
Store the ID of the record in session; this way, you always pull back the record and keep the value on the server. But when session dies, so does the link to the record.
Yes I'd highly recommend check permissions to the record if you store the ID in the URL.
I'm working on using the membership functionality of the ASP .Net sites. There are multiple ways to create users and one way is to create users and add a user profile to the system. The other is to use an enhanced wizard then add the user and then their profile information. Well, if you go route 1, then the user does not get a record inserted into the user profile table and then when the user goes to update their profile, then on the page load I would like the page to look for their record. If one does not exist, insert a blank one. Does anyone have a sample script to look up a user's profile based on their unique id in SQL CE? If the record does not exist (record count = 0) then insert a new blank record.
When I load up a grid view (which is supposed to display data of that user). However, when I log in as a user and view the grid view it displays both the current user's data and others' data. I want it to only display the current logged in user's data.
How would I use userid = convert.toint32(session["userId"].tostring()) to check my current logged in user's username and display only their data from the database's table?
Just make your query to get the data something like
"Select * from SomeTable Where UserId = #userId"
And then set the parameter to userid
Same way as you'd do a query based on user input.
Question No 1
I am familiar with role management, a particular member in a particular role can do this and access this functionally. What I need to do is Manage individual user, not the role he is in.
For example, lets say I create a role, called "Sales". I setup the role permission what the sales persons can do. Now i want to keep a check on individual user. For example if this is "john", i want to show him the records only he created. If his is peter, I want to show him only that records which he created, not by john or other sales people.
Is there a thing called "User Management" in ASP.NET that we can use? If not we have to create it ourselves and I believe the integration with ASP.NET "Role Management" will not be that smooth.
Question No 2.
I am using control for user login. I want to create a session at this time so I can keep track of which user is signed in so I can show him the records only pertaining to him. How can I do that?
Your Q1 isn't really about Role vs User management (ie: authorizations) at this point. It's about audit tracking within your application.
And the way you do that is you capture the ID of the user who created the record in question with the record, so that later you can filter on that ID.
Pseudo database structure
Table Sales
Field...
Field...
Field...
CreatedByUser int not null, -- Populate this on creation and never change it again
ModifiedByUser int not null - populate this on every row update including insert
See ASP.NET Profile Properties.
Assuming the records in the database correspond to a unique ID for a user, you can store the unique id in a profile property per user.
1) If you want to filter records by the creating user, you need to record in your table the ID of the user who created the record. You can access the name of current user through User.Identity.Name and their ID (provider-dependent) through User.ProviderUserKey.
2) Sessions are created automatically in ASP.NET and provided you have a properly configured MembershipProvider, you can retrieve all the needed user info using the User object as shown above.
It sounds like you are a little unfamiliar with ASP.NET Membership and Roles capabilities, because they are actually set up quite well to accomplish what you are describing. I would recommend checking out this tutorial series:
https://web.archive.org/web/20211020202857/http://www.4guysfromrolla.com/articles/120705-1.aspx
You are talking about Authentication and Authorization. For question 1 you and implement a custom authorization provider to allow for user level control http://msdn.microsoft.com/en-us/library/aa479048.aspx For question 2, once you log in and are Authenticated, the session contains a userprinciple object that has the info in it automatically.
In an asp.net webform app, I need to restrict the logged in user to show data only for their company. This is a primary key of my topmost table. How to I set that based off the user. I imagine I would have another table with some user ID mapped to company ID?
If a user can be part of exactly one company, then generally there would be a table of companies and a table of users, with the latter having a company ID foreign key column to the primary key of the former. The user object would then have the company ID throughout the application (such as in the cookie data or session data) and the application would apply filtering rules accordingly.