How to pass RouteData from RenderAction to Action Attribute - asp.net-mvc

Question

I'm using MVC 5 and I'm calling an Action from a View via Html.RenderAction(). I want to pass an ID parameter to the Action and I do it like so:
Html.RenderAction("MyAction", "MyController", new { id = resourceID });
My Action is something like this: public ActionResult MyAction(int id)
This works fine. However, I want to decorate the Action with my own custom AuthorizeAttribute in order to check if the current user has access to the resource with this specific ID. In my custom AuthorizeAttribute class I have something like this:
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
if (!base.AuthorizeCore(httpContext))
{
return false;
}
RouteData rd = httpContext.Request.RequestContext.RouteData;
var resourceID = rd.Values["id"];
SessionInfo sessionInfo = HttpContext.Current.Session["SessionInfo"] as SessionInfo;
int userID = sessionInfo.UserInfo.UserID;
return AuthorizationBusiness.DoesUserHaveAccessToResource(userID, int.Parse(resourceID.ToString()));
}
The problem is that the original Http request does not contain the id parameter, so resourceID will be null here. In order to workaround this problem, I added this parameter to the Request before calling RenderAction, like this:
Context.Request.RequestContext.RouteData.Values["id"] = resourceID;
Html.RenderAction("MyAction", "MyController", new { id = resourceID });
Now I can retrieve the ID within the AuthorizeAttribute, however, this doesn't feel like the right way to do it. What's the best way to achieve this? And can you tell me if there are any downsides in the way I'm doing it?
Thanks in advance!

Answer 1

If I understand correctly:
You are calling Html.RenderAction("MyAction", "MyController", new { id = resourceID });
This return a view on which Html.Action method is called
Action which is called by Html.Action is decorated with custom authorization attribute in order to check if the user is authorized to access it
If my understanding is correct then I would not implement additional authorize attribute but in the action which is called by Html.RenderAction("MyAction", "MyController", new { id = resourceID }) check if the user is authorized and if not modify the returned view so that the Html.Action won't be called.