asp.net mvc Ajout à l'attribut AUTHORIZE

Question

Comment créer un attribut personnalisé pour étendre l'attribut Authorize existant dans MVC?

Answer 1

Dérivez votre classe de AuthorizeAttribute. Remplacer la méthode OnAuthorization. Ajoutez et configurez CacheValidationHandler.

public void CacheValidationHandler(HttpContext context, 
            object data, 
            ref HttpValidationStatus validationStatus) 
{ 
    validationStatus = OnCacheAuthorization(new HttpContextWrapper(context)); 
} 


public override void OnAuthorization(AuthorizationContext filterContext) 
{ 
    if (filterContext == null) 
    { 
     throw new ArgumentNullException("filterContext"); 
    } 

    if (AuthorizeCore(filterContext.HttpContext)) 
    { 
     ... your custom code ... 
     SetCachePolicy(filterContext); 
    } 
    else if (!filterContext.HttpContext.User.Identity.IsAuthenticated) 
    { 
     // auth failed, redirect to login page 
     filterContext.Result = new HttpUnauthorizedResult(); 
    } 
    else 
    { 
     ... handle a different case than not authenticated 
    } 
} 


protected void SetCachePolicy(AuthorizationContext filterContext) 
{ 
    // ** IMPORTANT ** 
    // Since we're performing authorization at the action level, the authorization code runs 
    // after the output caching module. In the worst case this could allow an authorized user 
    // to cause the page to be cached, then an unauthorized user would later be served the 
    // cached page. We work around this by telling proxies not to cache the sensitive page, 
    // then we hook our custom authorization code into the caching mechanism so that we have 
    // the final say on whether a page should be served from the cache. 
    HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache; 
    cachePolicy.SetProxyMaxAge(new TimeSpan(0)); 
    cachePolicy.AddValidationCallback(CacheValidationHandler, null /* data */); 
} 

Answer 2

public class CoolAuthorizeAttribute : AuthorizeAttribute 
{ 
} 

Answer 3

Vous n'avez pas besoin d'étendre cet attribut, web.config est suffisant. S'il vous plaît lire à propos de forms Element for authentication. Portez votre attention sur defaultUrl. C'est quelque chose dont vous avez besoin.

<system.web> 
    <authentication mode="Forms"> 
    <forms defaultUrl="YourUrlGoesHere"/> 
    </authentication> 
</system.web> 

Answer 4

Je suggère si vous voulez juste étendre le AuthorizeAttribute actuel et ajouter votre propre autorisation en plus de cela, au lieu de passer outre OnAuthorization simplement remplacer AuthorizeCore et ajoutez votre condition de MyCustomAuthorizationHolds à elle.

public class CustomAuthorizeAttribute : AuthorizeAttribute 
{ 
    // This method must be thread-safe since it is called by the thread-safe OnCacheAuthorization() method. 
    protected override bool AuthorizeCore(HttpContextBase httpContext) 
    { 
     if (base.AuthorizeCore(httpContext) && MyCustomAuthorizationHolds) 
      return true; 

     return false; 
    } 
}