title: mvc security and access control
body: <p>I am new to MVC and I want to know how security and access control is handled within MVC.</p>
  
  <p>My case is, let's say I am managing an website where user can post a note that is not accessible by other user unless permission is given to do so.
  My database is currently structured as below.</p>
  
  <p>User</p>
  
  <ul>
  <li>User ID int</li>
  </ul>
  
  <p>Note</p>
  
  <ul>
  <li>User ID int</li>
  </ul>
  
  <p>User_Owns_Note</p>
  
  <ul>
  <li>User ID int</li>
  <li>Note ID int</li>
  </ul>
  
  <p>User_Owns_Note table has data of</p>
  
  <ul>
  <li>1, 3</li>
  <li>3, 1</li>
  <li>3, 2</li>
  <li>1, 1</li>
  <li>2, 5</li>
  </ul>
  
  <p>Let's then say I have below URL and which will only be accessible by users with UserID 3 and 1 according to the owns note table.</p>
  
  <ul>
  <li>/Note/Edit/1</li>
  </ul>
  
  <p>What is the best practice to implement this kind of restriction ?</p>
  
  <p>I can simply look up the table in the Edit Action and redirect to other page if user doesn't have access. But my problem is then when I implement new Delete action, or whatever actions in the future, I need to place the same code at the start of each action. Is this only way to implement this ? </p>
  
  <p>Thanks in advance...</p>