HandleUnauthorizedRequest去InfiniteLoop

Question

我有以下兩個操作，不斷調用對方，並進入無限循環。我究竟做錯了什麼？

Public Overrides Sub OnAuthorization(filterContext As System.Web.Mvc.AuthorizationContext) 
     'This calls the AuthorzeCore function and also makes sure that the browser does not cache this function 
     MyBase.OnAuthorization(filterContext) 
     If Not IsNothing(filterContext.Result) Then 
      Return 
     End If 
     'Gets the calling Controller 
     Dim controllerName As String = filterContext.Controller.GetType().Name 
     'Gets the calling action 
     Dim actionName As String = filterContext.ActionDescriptor.ActionName 

     'Checks whether the logged in user has access to the action of the controller 
     Dim canAccess As test.Security.Permissions.PermissionTypes 
     canAccess = test.ApplicationSecurity.GetSecurityObject().GetAccess(controllerName & "." & actionName) 
     If canAccess = Security.Permissions.PermissionTypes.DISABLE Then 
      'User has access to the application but not to the action they are trying to access, so throw a Unauthorised exception 
      filterContext.HttpContext.Response.StatusCode = 403 
      HandleUnauthorizedRequest(filterContext) 
     End If 

    End Sub 

    Protected Overrides Sub HandleUnauthorizedRequest(filterContext As System.Web.Mvc.AuthorizationContext) 
     ''To make sure that we throw a not authorised error rather not authenticated message 
     'If filterContext.HttpContext.Request.IsAuthenticated Then 
     ' 'filterContext.Result = New HttpStatusCodeResult(CType(System.Net.HttpStatusCode.Forbidden, Int32)) 
     ' filterContext.Result = New RedirectToRouteResult(
     'Else 
     ' MyBase.HandleUnauthorizedRequest(filterContext) 
     'End If 
     If (filterContext.HttpContext.Request.IsAjaxRequest()) Then 
      Dim urlHelper As UrlHelper = New UrlHelper(filterContext.RequestContext) 
      filterContext.Result = New JsonResult With {.Data = New With {.Error = "NotAuthorized", .URL = urlHelper.Action("UnAuthorized", "Error")}, _ 
                 .JsonRequestBehavior = JsonRequestBehavior.AllowGet} 
     ElseIf filterContext.HttpContext.Response.StatusCode = 403 Then 
      filterContext.Result = New ViewResult With {.ViewName = "UnAuthorized"} 
     Else 
      filterContext.Result = New ViewResult With {.ViewName = "UnAuthenticated"} 

     End If 
    End Sub 

Answer 1

你不應該從內部OnAuthorization調用HandleUnauthorizedRequest，當請求不能被批准此方法是自動調用。

從docs：

授權被拒絕在以下情況：

•請求不與任何用戶相關聯。

•用戶未通過身份驗證。

•用戶已通過身份驗證，但不在授權的用戶組（如果已定義）中，或者用戶未處於授權角色的任何 （如果已定義）。

如果授權被拒絕，則此方法將調用 HandleUnauthorizedRequest（HttpActionContext）來處理 未授權請求。