asp.net mvc authorization using roles

Question

I\'m creating an asp.net mvc application that has the concept of users. Each user is able to edit their own profile. For instance:

• PersonID=1 can edit thei

Answer 1

My $.02:

Authorized & authenticated are two different things. Simply put, the question is can you do this thing are you supposed to do it? You can pick your friends, you can pick your nose but you can't pick your friends nose! There's no need to check authorization if every role can do it (user has hand and a nose). Have a Post method for users to get to their own profile and test the profile id w/the form's hidden values or redirect (not your nose, go away).

Have a Get method for editing others profiles and just check for the admin role here - (I'm a doctor, I'm authorized to stick things up your nose)...