Michael's Blog

David Barkol writes on his blog about ASP.NET AJAX Role Application Service with Visual Studio 2008 (Orcas). Well, it is a new service that is working similar to the profile and authentication service. As it is very easy to call it from the client-side JavaScript code you should be a little bit more careful using these new methods.

When you read David's post you will find a very simple example (and exactly there you can already see what I mean with careful:

function pageLoad() {
    loadRoles();
}

function loadRoles() {
    Sys.Services.RoleService.load(onLoadRolesCompleted, 
                                  onLoadRolesFailed, null);
}

function onLoadRolesCompleted(result, userContext, methodName) {
    if (Sys.Services.RoleService.isUserInRole("Administrator")) {
        $get("adminView").style.display = "block";
    }
}

function onLoadRolesFailed(error, userContext, methodName) {
    alert(error.get_message());
}

In the asyncronous callback method onLoadRolesCompleted you see the if statement isUserInRole("Administrator"). If it is true the next line will simple display the HtmlElement with the ID adminView in the Web browsers window which is by default hidden. So, instead of running this method you could run following command at your own to enable the adminView display:

document.getElementById("adminView").style.display = "block";

This is not yet a security problem, but if you call there another AJAX request which will do any administrative tasks it could be a problem.

You have to test ALWAYS on the server-side code if the user has the needed user rights to execute your code. You can do that at your own or use the PrincipalPermissionAttribute where you can specify roles that are allowed to execute the whole AJAX method. I recommend using the attribute because there is no code from the method executed until the user is in the correct role.

One year ago I already wrote a simple demonstration how to use the PrincipalPermissionAttribute inside Ajax.NET Professional AjaxMethods.