Authorization Logic — Query Builder

• Jan 17, 2025
• 2 minutes to read

DevExpress ASP.NET MVC Query Builder allows users to browse available data connections and tables. The Query Builder is integrated into both the DevExpress Report Designer and Dashboard Designer and can be used as a standalone control. To address CWE-285-related security risks, you should restrict access to data displayed within the Query Builder.

Apply Authorization Attributes

The Authorize attribute specifies authorization rules for application pages. To protect your application, apply the Authorize attribute to the controller class. Use the AllowAnonymous attribute to allow anonymous access to public actions:

namespace SecurityBestPractices.Mvc.Controllers {
    [Authorize]
    public partial class AuthorizationController : Controller {
        [AllowAnonymous]
        public ActionResult QueryBuilder() {
            return View("QueryBuilder/Index");
        }
    }
}

Implement Authorization Logic

Follow the steps below to implement authorization in the DevExpress Query Builder extension:

1. Implement a custom connection string provider to restrict access to connection strings:

2. Implement a custom database schema provider to restrict access to data tables, views, and stored procedures:

3. Register your custom providers in the Global.asax.cs file for the DevExpress Report Designer, Dashboard Designer, or standalone Query Builder: