asp.net mvc添加到AUTHORIZE属性

Question

如何在MVC中创建自定义属性以扩展现有的Authorize属性？

Answer 1

从AuthorizeAttribute派生你的类。重写OnAuthorization方法。添加并设置一个CacheValidationHandler。

public void CacheValidationHandler(HttpContext context, 
            object data, 
            ref HttpValidationStatus validationStatus) 
{ 
    validationStatus = OnCacheAuthorization(new HttpContextWrapper(context)); 
} 


public override void OnAuthorization(AuthorizationContext filterContext) 
{ 
    if (filterContext == null) 
    { 
     throw new ArgumentNullException("filterContext"); 
    } 

    if (AuthorizeCore(filterContext.HttpContext)) 
    { 
     ... your custom code ... 
     SetCachePolicy(filterContext); 
    } 
    else if (!filterContext.HttpContext.User.Identity.IsAuthenticated) 
    { 
     // auth failed, redirect to login page 
     filterContext.Result = new HttpUnauthorizedResult(); 
    } 
    else 
    { 
     ... handle a different case than not authenticated 
    } 
} 


protected void SetCachePolicy(AuthorizationContext filterContext) 
{ 
    // ** IMPORTANT ** 
    // Since we're performing authorization at the action level, the authorization code runs 
    // after the output caching module. In the worst case this could allow an authorized user 
    // to cause the page to be cached, then an unauthorized user would later be served the 
    // cached page. We work around this by telling proxies not to cache the sensitive page, 
    // then we hook our custom authorization code into the caching mechanism so that we have 
    // the final say on whether a page should be served from the cache. 
    HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache; 
    cachePolicy.SetProxyMaxAge(new TimeSpan(0)); 
    cachePolicy.AddValidationCallback(CacheValidationHandler, null /* data */); 
} 

Answer 2

public class CoolAuthorizeAttribute : AuthorizeAttribute 
{ 
} 

Answer 3

您不需要扩展此属性，web.config就足够了。请阅读有关forms Element for authentication。关注defaultUrl。这是你需要的东西。

<system.web> 
    <authentication mode="Forms"> 
    <forms defaultUrl="YourUrlGoesHere"/> 
    </authentication> 
</system.web> 

Answer 4

我建议，如果你只是想延长现行AuthorizeAttribute，并添加最重要的是你自己的授权，而不是覆盖OnAuthorization只是覆盖AuthorizeCore并添加MyCustomAuthorizationHolds条件吧。

public class CustomAuthorizeAttribute : AuthorizeAttribute 
{ 
    // This method must be thread-safe since it is called by the thread-safe OnCacheAuthorization() method. 
    protected override bool AuthorizeCore(HttpContextBase httpContext) 
    { 
     if (base.AuthorizeCore(httpContext) && MyCustomAuthorizationHolds) 
      return true; 

     return false; 
    } 
}