我对MVC中的自定义授权有疑问。
我有一个网站，我想根据其组成员身份来限制对某些页面的访问。现在，例如，如果有一个管理组和一个用户组，我已经看到了很多有关如何执行此操作的示例，但是没有任何有关第三级的示例。
例如，只有公司的用户才能查看自己公司的订单(每个公司都有自己的管理员，等等)。这些公司存储在数据库中。因此，我已经看到了执行自定义授权的方法，该方法重写了AuthorizeCore上的AuthorizeAttribute方法，但是我不知道如何访问传递给 Controller 的参数，以查看用户是否有权访问订单(例如订单ID) )。
这是进行检查的最佳场所，还是应该直接通过 Controller 的方法进行处理？
最佳答案
AuthorizationContext(OnAuthorize的参数)提供对Controller，RouteData，HttpContext等的访问。您应该能够在自定义授权过滤器中使用它们来执行所需的操作。以下是从AuthorizeAttribute派生的RoleOrOwnerAttribute的代码示例。
public override void OnAuthorization( AuthorizationContext filterContext )
{
if (filterContext == null)
{
throw new ArgumentNullException( "filterContext" );
}
if (AuthorizeCore( filterContext.HttpContext )) // checks roles/users
{
SetCachePolicy( filterContext );
}
else if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
{
// auth failed, redirect to login page
filterContext.Result = new HttpUnauthorizedResult();
}
// custom check for global role or ownership
else if (filterContext.HttpContext.User.IsInRole( "SuperUser" ) || IsOwner( filterContext ))
{
SetCachePolicy( filterContext );
}
else
{
ViewDataDictionary viewData = new ViewDataDictionary();
viewData.Add( "Message", "You do not have sufficient privileges for this operation." );
filterContext.Result = new ViewResult { MasterName = this.MasterName, ViewName = this.ViewName, ViewData = viewData };
}
}
// helper method to determine ownership, uses factory to get data context,
// then check the specified route parameter (property on the attribute)
// corresponds to the id of the current user in the database.
private bool IsOwner( AuthorizationContext filterContext )
{
using (IAuditableDataContextWrapper dc = this.ContextFactory.GetDataContextWrapper())
{
int id = -1;
if (filterContext.RouteData.Values.ContainsKey( this.RouteParameter ))
{
id = Convert.ToInt32( filterContext.RouteData.Values[this.RouteParameter] );
}
string userName = filterContext.HttpContext.User.Identity.Name;
return dc.Table<Participant>().Where( p => p.UserName == userName && p.ParticipantID == id ).Any();
}
}
protected void SetCachePolicy( AuthorizationContext filterContext )
{
// ** IMPORTANT **
// Since we're performing authorization at the action level, the authorization code runs
// after the output caching module. In the worst case this could allow an authorized user
// to cause the page to be cached, then an unauthorized user would later be served the
// cached page. We work around this by telling proxies not to cache the sensitive page,
// then we hook our custom authorization code into the caching mechanism so that we have
// the final say on whether a page should be served from the cache.
HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
cachePolicy.SetProxyMaxAge( new TimeSpan( 0 ) );
cachePolicy.AddValidationCallback( CacheValidateHandler, null /* data */);
}
关于asp.net-mvc - ASP.NET MVC自定义授权，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/971401/