Question

如果用户/用户/用户/净价/代用的用户网页是这样的话,我将不停地上网。

a) 身份。 IsAuthenticated = false

或经认证,

b) Idenitity.Name != user name of the user page they are trying to edit
c) Identity.UserType() != UserType.Administrator // This is like a Role, without using RoleProviders.

假定“u”可以把控制器或控制器的行动方法与某种东西脱钩,但我不敢确定什么?

Answer 1

见<代码>AuthorizeAttribute。

ASP.Net MVC: 有没有办法重写AuthorizeAttribute？

Answer 2

从AuthorizeAttribute获得的习俗是我使用的。 Override the OnAuthorize methods and implementing You own theory.

public class OnlyUserAuthorizedAttribute : AuthorizeAttribute
{
    public override void OnAuthorize( AuthorizationContext filterContext )
    {
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            filterContext.Result = new HttpUnauthorizeResult();
        }
        ...
    }
}

Answer 3

我实施了以下行动基金,并努力处理认证和作用。我在自己的非行桌子中扮演着这样的角色:

User
UserRole (contains UserID and RoleID foreign keys)
Role

public class CheckRoleAttribute : ActionFilterAttribute
{
    public string[] AllowedRoles { get; set; }


    public override void OnActionExecuting(ActionExecutingContext filterContext)
    {
        string userName = filterContext.HttpContext.User.Identity.Name;

        if (filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            if (AllowedRoles.Count() > 0)
            {
                IUserRepository userRepository = new UserRepository();
                User user = userRepository.GetUser(userName);
                bool userAuthorized = false;
                foreach (Role userRole in user.Roles)
                {
                    userAuthorized = false;
                    foreach (string allowedRole in AllowedRoles)
                    {
                        if (userRole.Name == allowedRole)
                        {
                            userAuthorized = true;
                            break;
                        }
                    }
                }
                if (userAuthorized == false)
                {
                    filterContext.HttpContext.Response.Redirect("/Account/AccessViolation", true);
                }
            }
            else
            {
                filterContext.HttpContext.Response.Redirect("/Account/AccessViolation", true);
            }
        }
        else
        {
            filterContext.HttpContext.Response.Redirect(FormsAuthentication.LoginUrl + String.Format("?ReturnUrl={0}", filterContext.HttpContext.Request.Url.AbsolutePath), true);
        }


    }

我这样说......

    [CheckRole(AllowedRoles = new string[] { "admin" })]
    public ActionResult Delete(int id)
    {
        //delete logic here
    }

友情链接