Search code examples
asp.net-mvcauthorize-attributeauthorize

Using [Authorize] on the GET and POST methods with same name


Maybe the answer to the following is simple, but I have hard time finding the answer:

When I have a GET method in a controller that is secured with the [Authorize] attribute, and a POST method (defined with [HttpPost]), will the same restrictions apply to it as well? Both methods have the same name, but differ in parameters.

Example code:

 [Authorize(Roles = "Administrator")]
 public ActionResult Delete()
 {
     return View();
 }

 [HttpPost]
 public ActionResult Delete(int id)
 {            
     /* the method's logic omitted */
     return RedirectToAction("Index");
 }

Solution

  • No, the controller considers these two separate actions (since that's what they are), and as such, don't share restrictions.