m having a security issue using mvc 5
I have a controller restaurant, I set the authorization
[Authorize(Roles = "Admin, RestAdmin")]
so when a RestAdminlog in, he will be redirected to the restaurant profile depending on the log in email, so the URL would be lets say: localhost:123/restaurant/1
but if i change the id from the URL say restaurant/2 i will be redirected to the profile of restaurant with id 2 without logging as RestAdmin 2
what shall I do so that if the user decided to change the id from the URL he should be forced to log in as the admin of that id?
Go to the complete details ...