This kind of authorization requires that you????????ll set properly the authorization on server side, this means, i.e. if you hide a link on the client-side, you also have to set the Authorize attribute on your controller action to avoid security leaks.