asp.net mvc 5 - MVC5 EF6 How to add confirmation screen with additional authentication before submitting data -

developing new mvc5 project. have scaffolding in place crud functionality there requirement when data inserted or updated, e-signature required. before data can submitted database user must presented page asking them enter username , password again confirm data. if username , password entered valid , username matches signed in user, original data entered can saved table (for example member) , e-signature information saved separate table (esignature). i'd appreciate on best way go - view model combining member , esignature, or reuse of loginviewmodel account controller check authentication, or alternative approach? need can use across half dozen controllers e-signatures required.

alright maybe approach not best attempt.

my solution create customattribute: authorizeattribute , decorate actions require esignature. in customattribute implementation redirect controller action similar login slight modification.

public class customauthorize : authorizeattribute     {         public override void onauthorization(authorizationcontext filtercontext)         {             base.onauthorization(filtercontext);              var url = filtercontext.httpcontext.request.url;             var query = url.query;             if (query.contains("g="))             {                 var code = query.split(new string[] { "g=" }, stringsplitoptions.none);                 //you can create time sensistive token , validate it.             }             else             {                 //redirect user particular page                 filtercontext.result = new redirecttorouteresult(                                         new routevaluedictionary                                      {                                                                         { "controller", "account" },                                     { "action", "elogin" },                                     { "redirecturl", url.absolutepath}                                     }                 );             }         }      } 

then decorate example index() method it.

[customauthorize] public actionresult index() {   return view(); } 

at first when hit index() method inside onauthorization method of customauthorizeattribute else loop gets executed , re-directs elogin method inside accountcontroller. method similar login httpget method. while specifying redirecttoresult specifying redirecturl path of current page when validate user inside elogin method of redirecturl can come back.

 [allowanonymous]         public actionresult elogin(string returnurl)         {             viewbag.returnurl = returnurl;             return view("login");         }          //         // post: /account/login         [httppost]         [allowanonymous]         [validateantiforgerytoken]         public async task<actionresult> elogin(loginviewmodel model, string returnurl)         {             if (modelstate.isvalid)             {                 var user = await usermanager.findasync(model.username, model.password);                 if (user != null)                 {                     await signinasync(user, model.rememberme);                     var url =  string.format("{0}/?g={1}", returnurl, "hashcode");                     return redirecttolocal(url);                 }                 else                 {                     modelstate.addmodelerror("", "invalid username or password.");                 }             }              // if got far, failed, redisplay form             return view(model);         } 

the difference in httppost elogin method before doing redirecttolocal append /g=hascode. note: here can append own logic create time sensitive hash. when redirected our home page can inspect inside our onauthorization method if url contains g=hashcode don't redirect login page.

this basic idea on how can approach force users re-sign in whenever hit specific controllers. have additional security checks , careful in exposing via url.