asp.net - simplemembership provider tied to system.web -

we use simplemembership provider in our app. however, feel validating user in role should part of business logic. simplemembership requires dependency on system.web not reference in business logic.

is there way decouple system.web simplemembership provider?

i not sure agree validating user in role should part of business logic. hear more details reasoning. if going put authorization in business logic here method still decouples security model business model. article explains how using new asp.net identity used in mvc 5, same concepts work simplemembership. dependent upon reasoning moving authorization business logic, the approach described here may meet requirements.

it appears comments trying reuse authorization logic placing in business logic, therefore not having rewrite authorization logic each type of client put in. fact logic different dependent upon client. take example of comparing authorization mvc view opposed web api. mvc framework provides 2 different authorizeattribute each because want behave differently on authorization failure. if authorization fails on view want redirect logon page. if authorization fails on web api call want return http unauthorized error. 2 different behaviors different types of clients access same business logic.

i think coupling security logic business logic make business logic less reusable across different implementations. in microsoft's business layer guidelines state, "do not mix authorization code , business processing code in same components." further decouple security model application using approach described here. allow change security model @ run-time instead of having recompile , redeploy application. , security model change.