title: How to get custom annotation attributes for a controller action in ASP.NET MVC 4?
body: <p>I am working with a permission based authorization system for my app in ASP.NET MVC. 
  For this I have created a custom authorization attribute</p>
  
  <pre><code>public class MyAuthorizationAttribute : AuthorizeAttribute
  {
      string Roles {get; set;}
      string Permission {get; set;}
  }
  </code></pre>
  
  <p>so that I can authorize a user by both role or a specific permission key with annotation for actions like</p>
  
  <pre><code>public class UserController : Controller
  {
      [MyAuthorization(Roles="ADMIN", Permissions="USER_ADD")]
      public ActionResult Add()
  
      [MyAuthorization(Roles="ADMIN", Permissions="USER_EDIT")]
      public ActionResult Edit()
  
      [MyAuthorization(Roles="ADMIN", Permissions="USER_DELETE")]
      public ActionResult Delete()
  }
  </code></pre>
  
  <p>then I override AuthorizeCore() method in MyAuthorizationAttribute class with similar logic(pseudo code)</p>
  
  <pre><code>protected override bool AuthorizeCore(HttpContextBase httpContext)
  {
      if(user not authenticated)
          return false;
  
      if(user has any role of Roles)
          return true;
  
      if(user has any permission of Permissions)
          return true;
  
      return false;
  }
  </code></pre>
  
  <p>Up to this is working fine. </p>
  
  <p>Now I need some sort of extension methods so that I can dynamically generate action url in view pages that will return action url based on MyAuthorization attribute authorization logic for the given action. Like</p>
  
  <pre><code>@Url.MyAuthorizedAction("Add", "User")
  </code></pre>
  
  <p>will return url to "User/Add" if user has admin role or has permission of "USER_ADD" (as defined in attributes for the action) or return empty string otherwise.</p>
  
  <p>But after searching in internet for few days I could not figure it out. :(</p>
  
  <p>So far I have found only this <a href="https://stackoverflow.com/questions/2721869/security-aware-action-link/2722026">&quot;Security aware&quot; action link?</a> which works by executing all action filters for the action until it fails.</p>
  
  <p>It's nice, but I think it would be an overhead to execute all the action filters for each time I call the MyAuthorizedAction() method. Besides It also didn't work with my version (MVC 4 and .NET 4.5)</p>
  
  <p>What all I need is to check authenticated user's role, permissions (will be stored in session) against authorized role and permission for the given action. Like something as following (pseudo code)</p>
  
  <pre><code>MyAuthorizedAction(string actionName, string controllerName)
  {
      ActionObject action = SomeUnknownClass.getAction(actionName, controllerName)
      MyAuthorizationAttribute attr = action.returnsAnnationAttributes()
  
      if(user roles contains any in attr.Roles 
         or 
         user permissions contains any attr.Permissions)
      {
          return url to action
      }
      return empty string
  }
  </code></pre>
  
  <p>I am searching the solution of getting action attributes value for quite a long time, could not find enough good resources at all. Am I missing out right keywords? :/</p>
  
  <p>If anyone can provide me the solution that would be truly a great help.
  Thanks in advance for the solutions</p>