I've implemented a security framework around Authorization Manager that works by hiding/modifying the output of controls in a Web Form depending on the permissions of the current user. This is all done automatically via page and usercontrol base classes. Works well.
One annoying aspect of my system is the fact that in order to make absolutely sure a bad guy doesn't do something he shouldn't be able to do, I have to also manually perform an access check in any sensitive event handlers. The reason being that a person could craft a page which includes controls that weren't actually visible to the user and simulate a button click or some other event that they shouldn't have access to. If I didn't perform an extra check in the event handler itself, this would perform some action they shouldn't have access to.
I'd love to be able to intercept all events raise on a page, including those in child server / user controls, and examine them t ...
Go to the complete details ...