asp.net mvc添加到AUTHORIZE屬性

Question

如何在MVC中創建自定義屬性以擴展現有的Authorize屬性？

Answer 1

從AuthorizeAttribute派生你的類。重寫OnAuthorization方法。添加並設置一個CacheValidationHandler。

public void CacheValidationHandler(HttpContext context, 
            object data, 
            ref HttpValidationStatus validationStatus) 
{ 
    validationStatus = OnCacheAuthorization(new HttpContextWrapper(context)); 
} 


public override void OnAuthorization(AuthorizationContext filterContext) 
{ 
    if (filterContext == null) 
    { 
     throw new ArgumentNullException("filterContext"); 
    } 

    if (AuthorizeCore(filterContext.HttpContext)) 
    { 
     ... your custom code ... 
     SetCachePolicy(filterContext); 
    } 
    else if (!filterContext.HttpContext.User.Identity.IsAuthenticated) 
    { 
     // auth failed, redirect to login page 
     filterContext.Result = new HttpUnauthorizedResult(); 
    } 
    else 
    { 
     ... handle a different case than not authenticated 
    } 
} 


protected void SetCachePolicy(AuthorizationContext filterContext) 
{ 
    // ** IMPORTANT ** 
    // Since we're performing authorization at the action level, the authorization code runs 
    // after the output caching module. In the worst case this could allow an authorized user 
    // to cause the page to be cached, then an unauthorized user would later be served the 
    // cached page. We work around this by telling proxies not to cache the sensitive page, 
    // then we hook our custom authorization code into the caching mechanism so that we have 
    // the final say on whether a page should be served from the cache. 
    HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache; 
    cachePolicy.SetProxyMaxAge(new TimeSpan(0)); 
    cachePolicy.AddValidationCallback(CacheValidationHandler, null /* data */); 
} 

Answer 2

public class CoolAuthorizeAttribute : AuthorizeAttribute 
{ 
} 

Answer 3

您不需要擴展此屬性，web.config就足夠了。請閱讀有關forms Element for authentication。關注defaultUrl。這是你需要的東西。

<system.web> 
    <authentication mode="Forms"> 
    <forms defaultUrl="YourUrlGoesHere"/> 
    </authentication> 
</system.web> 

Answer 4

我建議，如果你只是想延長現行AuthorizeAttribute，並添加最重要的是你自己的授權，而不是覆蓋OnAuthorization只是覆蓋AuthorizeCore並添加MyCustomAuthorizationHolds條件吧。

public class CustomAuthorizeAttribute : AuthorizeAttribute 
{ 
    // This method must be thread-safe since it is called by the thread-safe OnCacheAuthorization() method. 
    protected override bool AuthorizeCore(HttpContextBase httpContext) 
    { 
     if (base.AuthorizeCore(httpContext) && MyCustomAuthorizationHolds) 
      return true; 

     return false; 
    } 
}