I have a method that returns a URL to send a user should they pass a login. My problem is two of these links are hard coded one of which is attempting to pass a variable to the model of that controller. My question is two fold:

A. Is this safe B. Is there a better way to do this without hard-coding things like this?

public class LoginViewModel
  public string UserId {get; set;}
  public string GetAppAccess()
    using (var db = new WebContext())
      var query = (from a in db.Permissions
                   join b in db.UserPermissions on a.PermissionId equals b.PermissionId
                   join c in db.Applications on a.Name equals c.AppName
                   where a.PermissionType == PermissionType.AppAccess & b.UserId == UserId
                   select c).ToList();
      switch (query.Count)
        case 0:
          return "http://SERVERNAME/Tickets/Create?subject=Request%20For%20Application%20Access";
          // TODO: code ticket logic to except this argument
        case 1:
          return query[0].AppUrl;
          return "http://SERVERNAME/Dashboard/" + UserId;
  • \$\begingroup\$ What is stopping anyone from "saving" the target URL for later/continued/unauthorized use? \$\endgroup\$ – EdSF Jun 14 '14 at 16:01
  • \$\begingroup\$ That would be handled by the controller they land on and user authentication. \$\endgroup\$ – aaronmallen Jun 14 '14 at 19:51
  • 1
    \$\begingroup\$ Are the return urls on different domains? Is this using MVC .NET? If so have you considered using RedirectToAction? \$\endgroup\$ – dreza Jun 14 '14 at 20:52
  • \$\begingroup\$ @dreza I have considered RedirectToAction, however I was trying to keep this logic out of the controller, maybe I could throw a using statement in there and utilize the RedirectToAction in the model... \$\endgroup\$ – aaronmallen Jun 15 '14 at 4:17
  • \$\begingroup\$ @aaronmallen how and when is the viewmodel used by the rest of the application? i.e. could you post your controller and or action code. \$\endgroup\$ – dreza Jun 15 '14 at 5:33

You are correct in feeling uneasy about the hardcoded URLs: I would put them in a config file.

By hardcoding them you will be forced to rebuild the project should you change to a different server while using a configuration file you can change it whenever you want and it will get picked up automatically.

| improve this answer | |
  • \$\begingroup\$ What about creating a variable that pulls the servername based on the URL? \$\endgroup\$ – aaronmallen Jun 13 '14 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.