Security Attribute on Event?

[xenophon]

I am using Role-based seucity Attributes on different methods in my
code-behind like this:

private void callmymethod()
{
try
{
mymethod();
}
catch{}


PrincipalPermission(SecurityAction.Demand , Role="1")]
private void mymethod()
{
}


Then any work in mymethod will fail quietly if the Principal does not
have a "1" role.

I want the same silent-fail on events that are wired to controls, but
I don't see how to do that. How do I do that on an event like this:

PrincipalPermission(SecurityAction.Demand , Role="1")]
private void button1_clic( object sender , EventArgs e )
{
}

Right now when the button is clicked, if the Principal does not have
the Role, the whole app grinds to a halt with an Exception.

Thanks.

 

[Steven Cheng[MSFT]]

Hi Xenophon,

Welcome to ASPNET newsgroup.
Regarding on the program on using Declarative role based security through
..net 's PrincipalPermission attribute in asp.net app, here are some of my
understanding:

The PrincipalPermissionAttribute will have the same behavior as we
programmatically use PrincipalPermission class instance to demand the
permission. Like:

PrincipalPermission permission = new PrincipalPermission(null, "Role1",
true);
permission.Demand();
So what's the behavior on your page is you use the above programmatical
demand?

Also, I'm not quite sure on the "quietly failed" you mentioned, when and
how does it happen? Is it only happen when you apply the security demand on
a helper function rather than control's event handler function?

If convenient, would you also send me a test page so that I can perform
the same test on my side?

Looking forward to your response. Thanks,

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

 

[xenophon]

Please close this issue, I have a workaround in effect.
Thanks.

 

[Steven Cheng[MSFT]]

Thank you for your followup xenophon.

Steven Cheng
Microsoft Online Support

Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)