Most web apps perform authorisation checks at the controller layer. This is basically ok, but complex apps tend to have repetitive checks. For example, there might be ten or so controller actions that operate on an Order, and every action needs to check that the current User is authorised to access that Order.

Some apps deal with this by having helper functions on Order, e.g. Order.isUserAuthz() and this does reduce code bloat. However, there is still the risk that a particular controller method forgets to call that function. From my experience pen testing, this is fairly common in complex apps.

Instead, how about having the model layer perform the authorisation check? So when you load an Order, it will only load if the current user is authorised. Because this is done by the model layer, there's no risk of the controller layer forgetting to make a call. Ultimately, what you're doing is reducing the amount of security-critical code, which reduces the risk of a coding error causing a vulnerability.

This seems like a good idea to me, but it is not common practice. Have you any thoughts on risks it could pose, or implementation difficulties?

1 Answer 1


Based on the way you have worded the question I'm assuming you mean in a .net MVC app.

Personally I view MVC as a presentation pattern. I tend to may my models pretty much DTOs. My controller is only responsible for passing data from the user into my service layer, and mapping the response to the DTO.

The service layer would contain all the authentication logic, and thus would be shared across many different controllers

My controllers are also responsible for translating internal security exceptions to appropriate http status codes.

Really controllers should be pretty empty of logic for exactly the reason you describe.

  • I was asking in general; I work mostly with Python and Java but I often advise clients working with .Net. So you are already doing exactly what I suggest. It sounds like .Net MVC encourages you in this direction anyway. Thanks - good to know it works for you.
    – paj28
    Oct 21, 2013 at 10:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .