Securing Sites using Dynamic Data

After taking a look at Dynamic Data when it first came out, I was instantly sold. While you could easily build an entire application around it, the main use I had in mind was as a set of ‘super admin’ pages for custom applications. The ability to simply drop the Dynamic Data code into a new or existing site to instantly have full table level management tools is incredibly useful.

However it's also something you'd probably want to secure, control, or limit in some ways.

Here’s the quick and easy way – if you need a more complex solution (such as differing levels of security based on a user’s role, and/or adding security info directly into your model) then check out the codeplex samples link at the end of this post.

1. If you’ve got a few sensitive tables, then don’t set ScaffoldAllTables to true. As handy as it might be.

2. Throw in some quick standard ASP.NET web.config security:

Modify the route definitions in your global.asax, prefixing them with a fictitious folder name:

RouteTable.Routes.Add(new DynamicDataRoute("IncrediblySecure/{table}/{action}.aspx")
{
    Constraints = new RouteValueDictionary(
        new
        {
            action = "List|Details|Edit|Insert",
            Model = model,
        }),
});

Then simply secure that folder using a location tag inside your application’s main web.config (or, create an empty folder and create a separate web.config inside it).

If you need something more elegant or flexible, then the Dynamic Data Samples on Codeplex page is for you. The brief reads:

Secure Dynamic Data

The Secure Dynamic Data Site allows or deny user's access to the database tables based on the user's authenticated role. Furthermore, it allows or denies user's table actions based on the user's authorization. The site integrates the ASP.NET forms authentication with a new concept of authorization provided by Dynamic Data.

 Print | Posted on Sunday, March 22, 2009 5:18 PM |