title: .net C#, what is the best practice for securing every method?
body: <p>I have a Web Project which has a Business Layer that handles some data operations. I would like to secure some or all methods by checking if there is an active not ended valid <code>Session</code> before executing the method. </p>
  
  <p>I first thought using <code>Attribute</code> over class but I couldn't run it properly. Since the class is a usual class and not derived from <code>System.Web.Page</code>. the attribute class never runs when the required BL instance is invoked. Besides, some of the methods might not require a valid session, so the whole class might not need a complete security. And also, adding a line that checks the session in every beginning of the method doesn't sound very promising.</p>
  
  <p>If you ask me why would I need to secure by method, I could explain like this:</p>
  
  <ul>
  <li>This is a web project</li>
  <li>Person might start out the from fill it but never got it save at that moment</li>
  <li>That screen waits about 30 mins lets say</li>
  <li>The session is already ended</li>
  <li>User is back in front of the computer, and clicks <strong>SAVE</strong> button, but process should NOT be completed</li>
  </ul>
  
  <p>Save operation could easily be a <code>DELETE</code> operation or a <code>SELECT</code>.</p>
  
  <p>Since there are many TYPEs of forms and stuff, I have <code>BL.ItemManager</code>, <code>BL.VideoManager</code>, <code>BL.ServiceManager</code> and so on... So, there are alot of save, delete and select methods inside of these classes.</p>
  
  <p>Therefore, is there a neat way to secure some methods by checking the session before running the process</p>