ANSWER:

I usually do it in this way. Probably your Order record should have a CreatedById field where you store the ID of the user who created it. When you get the OrderID from the Ajax call in your action method, build an Order object from that ID and check what is the CreatedByID value. Compare it with the current logged in UserId( you may have it in the session ?) and the decide whether to show the page to the user.

by Shyju from http://stackoverflow.com/questions/10307062