Edit Question - KnowledgeHub

Title Body

I've run into an interesting design issue with a class library I am writing. I have a custom implementation of the AuthorizeAttribute that I want clients to be able to use like this: [Protected("permission_name")] In the above code, PermissionAttribute inherits from AuthorizeAttribute and uses a local default (DefaultContext created using HttpContext). Behind the scenes, the attribute uses a SecurityService to check users, roles and permissions against (the SecurityService itself uses a client-provided persistence service that they can wire up in the composition root of their app). So my attributes need a reference to the SecurityService to function. Since Attribute constructors can only have compile-time constants, I cannot use constructor injection. I don't want to force my clients to use a DI framework - they should be able to discover and wire up the necessary dependencies in their composition root without using an IoC library, if they so choose. Here are my options: Have the library use a singleton SecurityService. Use property injection, which would work but it would make the dependency seem optional, which it is not and I don't know where I can do property injection in an MVC app on an authorize attribute. A possible solution to 2. above is to do set an instance of SecurityService as a static property on the attribute at application startup and use a guard clause to prevent it from being set more than once, like this: class ProtectedAttribute : ... { private static ISecurityService _SecurityService ; public static ISecurityService SecurityService { get { return _SecurityService ; } set { if (_SecurityService != null) throw new InvalidOperationException("You can only set the SecurityService once p

Tags (comma-separated) Cancel