title: ASP.MVC: Separation of concerns and custom attribute class w/ authorization
body: <p>I'm working on separating concerns in MVC. Currently everything is mixed up (Library functions, extensions, custom filter attributes, data access level), but I want to have 2 separate projects for those (MySolution.Lib and MySolution.DBModel). I want to separate my custom filter attribute to Lib project. DBModel is already referencing Lib, so I've done everything beside this one. What's the best way to implement this? Is it possible to pass to the attribute values in another custom property and work only on text inside Attribute implementation. So that the Attribute would be used something like this: </p>
  
  <pre><code>[AuthorizeUser(AccessLevel = "Admin", UserRights = DBModel.User.GetUserRights(HttpContext.User.Identity.Name)]
  public ActionResult MyAction()
  </code></pre>
  
  <p>Here's the current implementation</p>
  
  <pre><code>public class AuthorizeUserAttribute : AuthorizeAttribute
  {
      // Custom property
      public string AccessLevel { get; set; }
  
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          var isAuthorized = base.AuthorizeCore(httpContext);
          if (!isAuthorized)
          {
              return false;
          }
  
          List&lt;string&gt; accessLevels = AccessLevel.Split(new[] {','}).ToList();
  
          //this is taken from DB by GetUserRights() method from MySecurity static class
          var privilegeLevels = MySecurity.GetUserRights(httpContext.User.Identity.Name);
  
  
          return accessLevels.Any(privilegeLevels.Contains)
                 || privilegeLevels.Contains("Admin") || privilegeLevels.Contains("Super User");
      }
  
      protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
      {
          var helper = new UrlHelper(filterContext.RequestContext);
          filterContext.HttpContext.Response.Redirect(helper.Action("Index", "Unauthorized"));
      }
  
  }
  </code></pre>