帶參數Web API的自定義授權

Question

有人可以告訴我如何使用Customize AuthorizeAttribute中的參數嗎？

像這樣：

[Authorize(Role="Admin,Supervisor")] 

[Authorize(User="Me,You")] 

[Authorize(Action="abc,def")] 

現在這是我的代碼和我沒有任何想法還怎麼在這裏添加參數。

public class CustomAuthorizeAttribute : AuthorizeAttribute 
    { 
     ApplicationDbContext _context = new ApplicationDbContext(); 

     public override void OnAuthorization(HttpActionContext actionContext) 
     { 

      if (AuthorizeRequest(actionContext)) 
      { 

       return; 

      } 

      HandleUnauthorizedRequest(actionContext); 
     } 

     protected override void HandleUnauthorizedRequest(HttpActionContext actionContext) 
     { 
      if (((System.Web.HttpContext.Current.User).Identity).IsAuthenticated) 
      { 
       actionContext.Response = new HttpResponseMessage() 
       { 
        StatusCode = HttpStatusCode.Unauthorized, 
        Content = new StringContent("You are unauthorized to access this resource") 
       }; 

      } 
      else 
      { 
       base.HandleUnauthorizedRequest(actionContext); 
      } 
     } 

     private bool AuthorizeRequest(HttpActionContext actionContext) 
     { 
      var action = actionContext.ActionDescriptor.ActionName; 

      var controller = actionContext.ControllerContext.ControllerDescriptor.ControllerName; 

      var currentUser = actionContext.RequestContext.Principal.Identity.GetUserId(); 

      var user = _context.Users.Join(_context.UserAccesses, x => x.RoleId, y => y.RoleId, (x, y) => 
      new { Id = x.Id, firstName = x.firstName, lastName = x.lastName, RoleId = x.RoleId, Controller = y.Controller, 
       Action = y.Action }).Where(z => z.Id == currentUser && z.Controller == controller && z.Action == action) 
       .SingleOrDefault(); 

      if (user != null) 
       return true; 
      else 
       return false; 

     } 
    } 

Answer 1

正如你所延伸的Authorize默認實現，你需要使用[CustomAuthorize(Role="Admin,Supervisor")]。這將設置角色。您可以直接在代碼中訪問Roles屬性，因爲它們包含在已被繼承的父代AuthorizeAttribute中。

public override void OnAuthorization(HttpActionContext actionContext) 
    { 
     var roles = Roles; 
     if (AuthorizeRequest(actionContext)) 
     { 

      return; 

     } 

     HandleUnauthorizedRequest(actionContext); 
    }