xtrareports-402997-web-reporting-common-features-application-security-user-authorization.md
This topic describes how you can introduce user authorization to restrict access to reports and documents within a web-based reporting application.
Step 1 - Implement any standard ASP.NET authentication and authorization strategy to identify users.
To secure your web reporting application, you should prevent unauthorized access to the following objects on the server:
The access rule is as follows: only a user who initially creates a report can preview the report or load the exported document.
You can authorize the following requests:
To implement authorized access in web-based reporting applications, please review the following examples:
View Example: Implement User Authorization (ASP.NET MVC)
View Example: Implement User Authorization (ASP.NET Core)
Built-in ASP.NET authorization allows you to restrict access to handlers and controller actions (use the [Authorize] attribute).
The following table lists default routes that process requests from reporting components:
| Component | ASP.NET Web Forms, MVC | ASP.NET MVC Controllers | ASP.NET Core |
|---|---|---|---|
| Report Designer | DXXRD.axd | /ReportDesignerApi/Invoke | ReportDesignerController.DefaultUri |
| Document Viewer | DXXRDV.axd | /WebDocumentViewerApi/Invoke | WebDocumentViewerController.DefaultUri |
| Query Builder | DXQB.axd | /QueryBuilderApi/Invoke | QueryBuilderController.DefaultUri |
An application that uses our End-User Report Designer requires all three routes for proper operation.
You can implement custom handlers or custom controllers that inherit from controller classes with the [Authorize] attribute or perform access check.
You can add access control logic to report name resolution services - services which process a string argument (reportUrl) passed to the method that opens a report. The following services are available:
IReportProviderA recommended service for the Document Viewer and Report Designer. The primary advantage of IReportProvider service is that it can be attached to reports created at runtime. IReportProviderAsync uses asynchronous operations.ReportStorageWebExtensionThis service is called when no other report name resolution services are available. It is designed to obtain reports (stored in our REPX format) from external storage (a file or a database). Note that the GetData method returns a serialized report. If you use the GetData method to specify the default parameter value for a loaded report, set the Value property to the parameter value.
The following services have a higher priority than the previously mentioned services, although the scope of their use is limited.
IWebDocumentViewerReportResolver
Allows you to parse a report name, create a report instance, and return it to the calling method. If you have a parameterized report, you can specify parameters in the report name passed to the service and use parameters within the report’s constructor.
The IWebDocumentViewerReportResolver service is Intended for use only with the Web Document Viewer, and enables you to implement name resolution differently in the Report Designer and Document Viewer. The XRSubreport control does not use this service.
The IWebDocumentViewerReportResolver service does not support asynchronous mode.
Create and register the IWebDocumentViewerAuthorizationService service to implement authorization when the Document Viewer previews the document. The service is queried when the Document Viewer opens a report, and you can use the service to restrict access to the report itself. Service methods are called before document generation, and before any operation that reads the document.
Create and register the IExportingAuthorizationService service to implement authorization for exported documents. Access to the exported document can be granted only to the user who initiated the export operation.