webapi權限控制

webapi中的權限控制與mvc中的權限控制大致雷同，只是ActionFilterAttribute的命名空間不同

在mvc中，如當前用戶沒有權限，直接在自己的 ActionFilterAttribute 中return就可以，但是在webapi中需要執行  actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);才可以

我項目中的代碼如下

using System;
using System.Net;
using System.Net.Http;
using System.Web;
using System.Web.Http.Controllers;
using System.Web.Http.Filters;
using FrameWork.Core.Extends;
using iAssistantAPI.Authentication;
using iAssistantAPI.Models;

namespace iAssistantAPI.APIAttributes
{
    /// <summary>
    /// 基本驗證Attribtue，用以Action的權限處理
    /// </summary>
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false)]
    public class AuthenticationApiAttribute : ActionFilterAttribute
    {
        /// <summary>  
        /// 檢查用戶是否有該Action執行的操作權限  
        /// </summary>  
        /// <param name="actionContext"></param>  
        public override void OnActionExecuting(HttpActionContext actionContext)
        {
            if (LocalSetting.GetLocalSetting().EnablePermission)
            {
                if ((HttpContext.Current.Request.QueryString["HCPTicket"]).IsNullOrEmptyOrBlank())
                {
                    HttpContext.Current.Response.Redirect("~/api/DenyAnonymousAccess/DenyAnonymous");
                    actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
                    return;
                }
                else
                {
                    string ticket = HttpContext.Current.Request.QueryString["HCPTicket"].ToString();
                    ReturnModel rm = IdentityTicket.CheckTicketIsNotTimeOut(ticket);
                    if (rm.Result == false)
                    {
                        ////HttpContext.Current.Response.Write("{\"Result\":false,\"Info\":\"" + rm.Info + "\",\"RowCount\":0,\"ReturnData\":null}");
                        HttpContext.Current.Response.Redirect("~/api/DenyAnonymousAccess/LoginTimeout");
                        actionContext.Response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
                        return;
                    }
                }
            }
            else
            {
                base.OnActionExecuting(actionContext);
            }
        }

        /// <summary>
        /// 執行Action之后
        /// </summary>
        /// <param name="actionExecutedContext"></param>
        public override void OnActionExecuted(HttpActionExecutedContext actionExecutedContext)
        {
            base.OnActionExecuted(actionExecutedContext);
        }
    }
}

在需要權限控制的 action上或者control上標記此特性就可以了