title: asp.net mvc authorization using roles
body: <p>I'm creating an asp.net mvc application that has the concept of users.   Each user is able to edit their own profile.  For instance: </p>
  
  <ul>
  <li>PersonID=1 can edit their profile by going to <a href="http://localhost/person/edit/1" rel="noreferrer">http://localhost/person/edit/1</a></li>
  <li>PersonID=2 can edit their profile by going to <a href="http://localhost/person/edit/2" rel="noreferrer">http://localhost/person/edit/2</a></li>
  </ul>
  
  <p>Nothing particularly exciting there...</p>
  
  <p>However, I have run into a bit of trouble with the Authorization scheme.  There are only two roles in the system right now, "Administrator" and "DefaultUser", but there will likely be more in the future.</p>
  
  <p>I can't use the regular Authorize attribute to specify Authorization because both users are in the same role (i.e., "DefaultUser").</p>
  
  <p>So, if I specify the Authorize Filter like so:</p>
  
  <pre><code>[Authorize(Roles = "DefaultUser")]
  </code></pre>
  
  <p>then there is no effect.  PersonID=1 can go in and edit their own profile (as they should be able to), but they can also just change the URL to <a href="http://localhost/person/edit/2" rel="noreferrer">http://localhost/person/edit/2</a> and they have full access to edit PersonID=2's profile as well (which they should not be able to do).</p>
  
  <p>Does this mean that I have to create my own Authorization filter that checks if the action  the user is requesting "belongs" to them before allowing them access?  That is, if the edit action, with parameter = 1 is being requested by the currently logged in person, do I need to do a custom check to make sure that the currently logged in person is PersonID=1, and if so, authorize them, and if not, deny access?</p>
  
  <p>Feels like I'm missing something obvious here, so any guidance would be appreciated.</p>