How to protect pages in MVC - asp.net-mvc

Question

i am new in MVC but worked with web form for a long time. i used to protect pages in webform using location tag. so when any one try to access my product.aspx or SalesReport.aspx then user redirect to login page and after login they can access those pages.
<location path="product.aspx">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>
<location path="SalesReport.aspx">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>
so in MVC there is no concept like pages rather here we use controller and action method.
so guide me what people does in mvc to protect private pages through coding and config files
can we use location tag in mvc if yes then how......give me some sample.
how could i protect full controller and some time want to protect few action method inside the controller.
i guess protection can be done by coding and as well as manipulation config file. so i am looking for two different kind of approach.
so guide me how to protect files through code and how to protect files through manupulating config file like using location tag. thanks

Answer 1

You can write a custom action filter and apply that to your controllers /action methods as needed. This custom filter will check whether user is logged in or not and then either redirect the user to the login page or continue execution ( execute the action method and return a response )
Some thing like this. You may keep this in a BaseController class and inherit your other controllers from that.
public class BaseController : Controller
{
public class VerifyLogin : ActionFilterAttribute
{
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
bool validUser;
// check user is logged in or not here
//you may check Identity or Session or whatever method you want
//and set validUser value to true if user is valid/logged in
if(validUser)
{
return;
}
string baseUrl = filterContext.HttpContext.Request.Url.Scheme
+ "://" + filterContext.HttpContext.Request.Url.Authority
+ filterContext.HttpContext.Request.ApplicationPath.TrimEnd('/')
+ "/";
//Redirect user to login page
filterContext.Result = new RedirectResult(baseUrl + "account/login");
}
}
}
You can apply this filter on a controller or action methods.
Controller level
[VerifyLogin]
public ProductController : BaseController
{
public ActionResult Index()
{
return View();
}
}
Action method level
public SalesController : BaseController
{
[VerifyLogin]
public ActionResult SecretReport()
{
return View();
}
public ActionResult PublicReport()
{
//filter is not applied to this action method
return View();
}
}