title: ASP.NET MVC preventing users from direct URL
body: <p>So I've created a simple "hello world" in MVC as proof of concept. The index view list some made up records that are followed by the typical "edit", "details", and "delete" ActionLinks.</p>
  
  <p>However, depending on which AD group owns the record, I don't render some of those options. So for example, say I'm pulling up 5 records, and I'm a member of an Group\Role that only owns 1 of them. My Index page would look something like...</p>
  
  <p>Name   Price <br /> 
    Foo1  $10.00  Details <br />
    Foo2  $20.00  Details <br /> 
    Foo3  $30.00  Details | Edit | Delete <br />
    Foo4  $40.00  Details <br />
    Foo5  $50.00  Details <br />
    Foo6  $60.00  Details <br /></p>
  
  <p>This all works great. The Problem is, that as a user I can just type in a URL of /Home/Edit/Foo1 and it gives me Edit access to a record I do not own.</p>
  
  <p>On first search, it would seem like I am supposed to implement something called a ChildActionOnly Attribute. From what I've read, it sounds like if my controller was set to..</p>
  
  <pre><code>[ChildActionOnly]
  public ActionResult Edit(string id)
  {
      return View(GetItem(id));
  }
  </code></pre>
  
  <p>then it would not allow me to change my url and get there. However the moment I add that Attribute, the Action Link no longer works either.</p>
  
  <pre><code>@Html.ActionLink("Edit", "Edit", new { id = item.FooName })
  </code></pre>
  
  <p>I know I'm just missing something. I'm already implementing Authentication so unless you belong to the correct Role, it already blocks ALL access to that controller. However, once you have access... it doesn't mean you have access to change anything and everything.</p>