0

I want a MVC Action(say DoStuff()) to be called only via RedirectToAction method from another action.

I want to restrict calling this action "DoStuff" from browser urls.

I tried ChildActionOnly and NonAction.

But both failed. How do i achieve this?

tereško
  • 58,060
  • 25
  • 98
  • 150
Rockstart
  • 2,337
  • 5
  • 30
  • 59
  • 4
    You cannot reliably restrict this. It's patently impossible. You can use the url referrer field, but this is easily spoofed by anyone that knows what they're doing. This is why it's not reliable. – Erik Funkenbusch Sep 06 '14 at 21:12
  • If your action which is invoking the RedirectToAction resides within the same controller you can declare your action that you want to be restricted as private. That way methods/actions within this controller can invoke it but the action won't be accessible outside of that particular controller. If you are referencing it from other controllers then it can't be done as @ErikFunkenbusch points out... – Marko Sep 06 '14 at 21:59
  • @Marko - No, RedirectToAction results in a redirect, which is a new request, which comes from the client. It won't be accessible if it's private – Erik Funkenbusch Sep 06 '14 at 22:22
  • @ErikFunkenbusch Hmmm I guess you are correct I just tried it and I was unable to redirect to a private action from another action inside the same controller... – Marko Sep 06 '14 at 22:42
  • However I am able to return a call to a private ActionResult which then can return whatever view you want. It's not a redirect but it does allow you to create an action which is not accessible to the outside world and kind of serves the same idea with a redirect. Not sure what his scenario is but it might be useful to him... – Marko Sep 06 '14 at 22:46
  • Does this answer your question? [Only allow access to action if redirected from specific action](https://stackoverflow.com/questions/3864366/only-allow-access-to-action-if-redirected-from-specific-action) – Mustafa Ekici Mar 19 '23 at 14:17

0 Answers0