c# - Should authorization validation be in the controller or business logic -

i have internal crm system ability customers see invoices.

the 5th line in function checks if invoice belongs logged in customer (if (invoice.customerid != loggerincustomerid)).

i not sure if check should done.

public actionresult viewinvoice(guid invnum)     {         int loggerincustomerid = gettheloggedincustomerid();         invoice invoice = _invoicelogic.getinvoice(invnum);          if (invoice.customerid != loggerincustomerid)         {             //invalid action             return redirecttoaction("index", "myinvoices");         }         //do other stuff normal     } 

should check moved business logic? getinvoice take in invoice number parameter , parameter logged in user. getinvoice check , throw exception, have try catch in action method.

or there better way this?

should check moved business logic?

yes can , in case have pass logged in user identity bl method call. don't see wrong keeping check in controller itself.

you anyways, getting invoice bl calling getinvoice() , making check see action taken , me makes sense keeping check in controller action rather having in business layer.

but yes, it's kind of argumentative question though.