"Secure",
"Secure/{*arguments}",
new { controller =
"Secure", action =
"Index" },new { local =
new
LocalConstraint() }
);
routes.MapRoute(
"Default",
// Route name
"{controller}/{action}/{id}",
// URL with parameters
new { controller =
"Home", action =
"Index", id =
"" }
// Parameter defaults
);
This is when I noticed something. I know that the route engine will continue checking route entries until it finds a match (or show an error if it cant find a match) but I thought this only applied to the url parameter and not a combination of the url and
the applied constraints. So what I found out is in order for a MapRoute to be executed both the URl and Contraints all have to be satisfied or it will try the next route in the list.
So if my LocalContraint returns true and the url is /Secure then my SecureController is invoked, however if the LocalConstraint returns false and the path is /Secure the route mapping is ignored, the SecureController isn't invoked (correct behaviour) and
the route engine finds a match with the Default route and the page is displayed anyway. Stephen mentions this in this blog entry
"It is important to understand that even though this particular route cannot be accessed by an anonymous user, a later route might map an anonymous user to the same controller and controller action. For example, if the Admin route is followed by the following
Default route, then a user can access the Admin pages
For this reason, you should explicitly exclude the Admin pages from the Default route with an explicit constraint."
Could anyone explain to me how to modify the Default route to exclude the /Secure path?
*sigh* Ofc you are right.. the sad thing is that I read the entire article the other day and now that you mention it I get a clear memory about it as well [:P]
Andreas Håka...
Member
53 Points
28 Posts
MapRoute and Constraints
Aug 11, 2008 12:46 PM|LINK
I just installed Preview 4 to try out the framework I've read so much about on various blogs and I ran into a small snag when it comes to assigning new map routes in the global.asax file. I am trying out the IRouteConstraint extensibility and decided to try out Stephen Walthers (http://weblogs.asp.net/stephenwalther/archive/2008/08/06/asp-net-mvc-tip-30-create-custom-route-constraints.aspx) code example for a LocalConstraint.
routes.MapRoute(
"Secure", "Secure/{*arguments}", new { controller = "Secure", action = "Index" },new { local = new LocalConstraint() });
routes.MapRoute(
"Default", // Route name "{controller}/{action}/{id}", // URL with parameters new { controller = "Home", action = "Index", id = "" } // Parameter defaults);
This is when I noticed something. I know that the route engine will continue checking route entries until it finds a match (or show an error if it cant find a match) but I thought this only applied to the url parameter and not a combination of the url and the applied constraints. So what I found out is in order for a MapRoute to be executed both the URl and Contraints all have to be satisfied or it will try the next route in the list.
So if my LocalContraint returns true and the url is /Secure then my SecureController is invoked, however if the LocalConstraint returns false and the path is /Secure the route mapping is ignored, the SecureController isn't invoked (correct behaviour) and the route engine finds a match with the Default route and the page is displayed anyway. Stephen mentions this in this blog entry
"It is important to understand that even though this particular route cannot be accessed by an anonymous user, a later route might map an anonymous user to the same controller and controller action. For example, if the Admin route is followed by the following Default route, then a user can access the Admin pages
For this reason, you should explicitly exclude the Admin pages from the Default route with an explicit constraint."
Could anyone explain to me how to modify the Default route to exclude the /Secure path?
Thanks!
andreas (at) selfinflicted.org
MelvynHarbou...
Star
8005 Points
1288 Posts
Re: MapRoute and Constraints
Aug 11, 2008 03:09 PM|LINK
The answer is actually also within his blog entry: you just didn't read quite far enough!
The section is 'Creating a NotEqual Constraint' and its immediately after the comment about needing an explicit constraint!
Andreas Håka...
Member
53 Points
28 Posts
Re: MapRoute and Constraints
Aug 11, 2008 04:08 PM|LINK
*sigh* Ofc you are right.. the sad thing is that I read the entire article the other day and now that you mention it I get a clear memory about it as well [:P]
andreas (at) selfinflicted.org
MelvynHarbou...
Star
8005 Points
1288 Posts
Re: MapRoute and Constraints
Aug 11, 2008 04:12 PM|LINK
Can you mark my post as the answer then please?