c#權限驗證

在開發過程中，需要對訪問者的身份做權限驗證（再filter中進行權限過濾）。

在每次進入控制器方法之前進行調用：如

    [ControllerAuth]
    [RoutePrefix("ClinicCall")]
    public class ClinicCallController : ApiController

權限驗證的處理：

using GoodDoctor.CloudClinic.Trading.Domain.CM;
using GoodDoctor.CloudClinic.Trading.Webapi.Models.DTO;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
using System.Web;
using System.Web.Http;
using System.Web.Http.Controllers;

namespace GoodDoctor.CloudClinic.Trading.Webapi.Filter
{
    public class ControllerAuthAttribute : System.Web.Http.AuthorizeAttribute
    {
        private string _token;//請求Token

        public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)
        {
            var attributes = actionContext.ActionDescriptor.GetCustomAttributes<AllowAnonymousAttribute>().OfType<AllowAnonymousAttribute>();
            bool isAnonymous = attributes.Any(a => a is AllowAnonymousAttribute);
            if (!isAnonymous)
            {
                //從http請求的頭里面獲取身份驗證信息，驗證是否是請求發起方的token
                var authorization = actionContext.Request.Headers.Authorization;
                if ((authorization != null) && (authorization.Parameter != null))
                {
                    //用戶token,並校驗用戶名密碼是否匹配
                    _token = authorization.Parameter;

                    var result = IsAuthorized(actionContext);
                    if (!result)
                    {
                        HandleUnauthorizedRequest(actionContext);
                    }
                }
                else
                {
                    HandleUnauthorizedRequest(actionContext);
                }
            }
        }
        /// <summary>
        /// 驗證權限 
        /// </summary>
        /// <param name="actionContext"></param>
        /// <returns></returns>
        protected override bool IsAuthorized(HttpActionContext actionContext)
        {
            bool hasPermission = false;
            if (actionContext == null || actionContext.RequestContext == null || actionContext.RequestContext.Principal == null)
            {
                return hasPermission;
            }
            var user = actionContext.RequestContext.Principal as ClaimsPrincipal;
            if (user == null || user.FindFirst("given_name") == null)
            {
                return hasPermission;
            }
            var phone = user.FindFirst("given_name").Value;
            using (var context = new YZS_TRAEntities())
            {
                var entity = context.醫生診所.FirstOrDefault(o => o.醫生手機號 == phone && o.是否啟用.Value);
                if (entity != null)
                {
                    hasPermission = true;
                }
            }
            return hasPermission;
        }

    }
}