Put data from database into Session in MVC - asp.net-mvc

Question

I currently working on an extension of the filter [Authorize], so that I can retrieve the permissions from the database. Everything works, but it is sure a performance issue. Every time I send a query to the database, asking for permission, and that is not the best way to determine this. So I thought to put these data in the Session. What is the fastest way to put a data from database in to Session object which I could ask (LINQ) as well as databases.
Now this looks like:
var _allowedRolesDB = context.sec_RolesInCAs
.Where(rl => rl.MenuControlName == controllRights && rl.MenuActionName == actionRights)
.Select(rl => rl.RoleName);
foreach (var r in _allowedRolesDB)
{
RolesDB = RolesDB + r.ToString() + ",";
}
but I want change to
var _allowedRolesDB = MySuperSessionSomethink
.Where(rl => rl.MenuControlName == controllRights && rl.MenuActionName == actionRights)
.Select(rl => rl.RoleName);
foreach (var r in _allowedRolesDB)
{
RolesDB = RolesDB + r.ToString() + ",";
}
where MySuperSessionSomethink will keep one-time-retrieved data from database. Any idea how I can do this? Tx for help.
BIGGER PICTURE
Ok. I will show bigger picture.
Whole idea is to create custom authorize filter.
[CustomAuthAttribute("Home,Index", Roles = "SuperAdministrator")]
public ActionResult Index()
{
ViewBag.Message = "Welcome to ASP.NET MVC!";
return View();
}
What is a goal of this. Create authorize attribute which has all benefits, plus additional features like keep information about rights in database.
Now what I do is:
public CustomAuthAttribute(params string[] controllerAction)
{
IPrincipal user = HttpContext.Current.User;
string userName = user.Identity.Name;
**... some code .. and take all allowed roles and check it have permissions**
var _allowedRolesDB = context.sec_RolesInCAs
.Where(rl => rl.MenuControlName == controllRights && rl.MenuActionName == actionRights)
.Select(rl => rl.RoleName);
foreach (var r in _allowedRolesDB)
{
RolesDB = RolesDB + r.ToString() + ",";
}
**... some code .. thesame withs single users**
}
After this i use
protected override bool AuthorizeCore(HttpContextBase httpContext)
{
**... can acces or not part of code ...**
if (_rolesSplit.Any(user.IsInRole))
{
return true;
}
}
But there is the problem. Everytime I ask database about permissions, and this IMHO is not best way. Now my idea is take all permissions for one user and put him into his session when hi is authorized. Maybe I'm wrong and this way will make problems, but keep in database and ask all the time about permissions is not good idea too :). So maybe better way to take data and use in code after only one or two questions to the database?

Answer 1

First of all, it seems like you would want to add these to the cache, and not the session. They seem global to the application, not specific to the user. Since you're doing a lookup of roles by menu control/action, I would just add them to the cache as a lookup:
string action = controlRights + actionRights;
string allowedRoles = Cache[action];
if (allowedRoles == null)
{
allowedRoles = String.Join(",", context.sec_RolesInCAs
.Where(rl => rl.MenuControlName == controlRights && rl.MenuActionName == actionRights)
.Select(rl => rl.RoleName)
.ToArray());
Cache[action] = allowedRoles;
}
This will give you the allowed roles for the given control/action, from the cache on the second request.