Favor Privileges over Role Checks
A very common practice in web applications, especially those written using the ASP.NET built-in Role provider (circa ASP.NET 2.0 / 2005), is to perform role checks throughout the code to determine whether a user should have access to a particular page or control or command. For instance, you might see something like this: if (CurrentUser.IsInRole(Roles.Administrators) || CurrentUser.IsInRole(Roles.SalesAgents)) { SomeSpecialControl.Visible = true; } The problems with the maintainability of this approach become apparent after a short while. For one, any buttons or other controls on the SomeSpecialControl above that post back to the page should also do a … more