Right now, my user table has a bool called Admin. As the code shows, if user.admin = true, the user is able to see the admin area button and access it.
@if (Common.UsuarioLogueado.Admin) {
<li><a href="@Url.Action("List","ClientesAdmin",new { Area = "Admin" })">Admin control panel</a></li>
}
This is working as intended. However, non admin users can still go to the control panel by accessing it´s url http://localhost/appName/admin/ClientesAdmin/list
How do I prevent such thing? I was thinking about showing an error msg