I have a method that returns a URL to send a user should they pass a login. My problem is two of these links are hard coded one of which is attempting to pass a variable to the model of that controller. My question is two fold:

A. Is this safe B. Is there a better way to do this without hard-coding things like this?

public class LoginViewModel
  public string UserId {get; set;}
  public string GetAppAccess()
    using (var db = new WebContext())
      var query = (from a in db.Permissions
                   join b in db.UserPermissions on a.PermissionId equals b.PermissionId
                   join c in db.Applications on a.Name equals c.AppName
                   where a.PermissionType == PermissionType.AppAccess & b.UserId == UserId
                   select c).ToList();
      switch (query.Count)
        case 0:
          return "http://SERVERNAME/Tickets/Create?subject=Request%20For%20Application%20Access";
          // TODO: code ticket logic to except this argument
        case 1:
          return query[0].AppUrl;
          return "http://SERVERNAME/Dashboard/" + UserId;
  • \$\begingroup\$ What is stopping anyone from "saving" the target URL for later/continued/unauthorized use? \$\endgroup\$
    – EdSF
    Jun 14, 2014 at 16:01
  • \$\begingroup\$ That would be handled by the controller they land on and user authentication. \$\endgroup\$ Jun 14, 2014 at 19:51
  • 1
    \$\begingroup\$ Are the return urls on different domains? Is this using MVC .NET? If so have you considered using RedirectToAction? \$\endgroup\$
    – dreza
    Jun 14, 2014 at 20:52
  • \$\begingroup\$ @dreza I have considered RedirectToAction, however I was trying to keep this logic out of the controller, maybe I could throw a using statement in there and utilize the RedirectToAction in the model... \$\endgroup\$ Jun 15, 2014 at 4:17
  • \$\begingroup\$ @aaronmallen how and when is the viewmodel used by the rest of the application? i.e. could you post your controller and or action code. \$\endgroup\$
    – dreza
    Jun 15, 2014 at 5:33

1 Answer 1


You are correct in feeling uneasy about the hardcoded URLs: I would put them in a config file.

By hardcoding them you will be forced to rebuild the project should you change to a different server while using a configuration file you can change it whenever you want and it will get picked up automatically.

  • \$\begingroup\$ What about creating a variable that pulls the servername based on the URL? \$\endgroup\$ Jun 13, 2014 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.