webapi权限控制

webapi中的权限控制与mvc中的权限控制大致雷同，只是ActionFilterAttribute的命名空间不同

在mvc中，如当前用户没有权限，直接在自己的 ActionFilterAttribute 中return就可以，但是在webapi中需要执行  actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);才可以

我项目中的代码如下

using System;
using System.Net;
using System.Net.Http;
using System.Web;
using System.Web.Http.Controllers;
using System.Web.Http.Filters;
using FrameWork.Core.Extends;
using iAssistantAPI.Authentication;
using iAssistantAPI.Models;

namespace iAssistantAPI.APIAttributes
{
    /// <summary>
    /// 基本验证Attribtue，用以Action的权限处理
    /// </summary>
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false)]
    public class AuthenticationApiAttribute : ActionFilterAttribute
    {
        /// <summary>  
        /// 检查用户是否有该Action执行的操作权限  
        /// </summary>  
        /// <param name="actionContext"></param>  
        public override void OnActionExecuting(HttpActionContext actionContext)
        {
            if (LocalSetting.GetLocalSetting().EnablePermission)
            {
                if ((HttpContext.Current.Request.QueryString["HCPTicket"]).IsNullOrEmptyOrBlank())
                {
                    HttpContext.Current.Response.Redirect("~/api/DenyAnonymousAccess/DenyAnonymous");
                    actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
                    return;
                }
                else
                {
                    string ticket = HttpContext.Current.Request.QueryString["HCPTicket"].ToString();
                    ReturnModel rm = IdentityTicket.CheckTicketIsNotTimeOut(ticket);
                    if (rm.Result == false)
                    {
                        ////HttpContext.Current.Response.Write("{\"Result\":false,\"Info\":\"" + rm.Info + "\",\"RowCount\":0,\"ReturnData\":null}");
                        HttpContext.Current.Response.Redirect("~/api/DenyAnonymousAccess/LoginTimeout");
                        actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
                        return;
                    }
                }
            }
            else
            {
                base.OnActionExecuting(actionContext);
            }
        }

        /// <summary>
        /// 执行Action之后
        /// </summary>
        /// <param name="actionExecutedContext"></param>
        public override void OnActionExecuted(HttpActionExecutedContext actionExecutedContext)
        {
            base.OnActionExecuted(actionExecutedContext);
        }
    }
}

在需要权限控制的 action上或者control上标记此特性就可以了