.net中的身份認——AuthorizeAttribute

1..net自己的AuthorizeAttribute類來實現用戶身份驗證

AuthorizeAttribute類有兩個重要的方法:AuthorizeCore和HandleUnauthorizedRequest。其中AuthorizeCore函數是用來判斷一個請求是否通過用戶驗證，它的返回結果是一個bool。HandleUnauthorizedRequest函數則是在AuthorizeCore返回結果是false時會調用的函數。源代碼如下所示：

 

實例：

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false)]
    public class CheckAttribute : AuthorizeAttribute
    {
        #region Methods

        protected override bool AuthorizeCore(HttpContextBase context)
        {
            var cookie = HttpContext.Current.Request.Cookies["ctoken"];
            if (cookie != null && !string.IsNullOrEmpty(cookie.Value))
            {
                var redis = new RedisService();
                var r = redis.GetUser(cookie.Value);
                if (r.Item1 && (string.IsNullOrEmpty(LoginSysUser.GetUserName()) || r.Item2 != LoginSysUser.GetUserName()))
                {

                    var mUser = new UserService().FindByUserName(r.Item2);

                    new LoginSysUser()
                    {
                        Id = mUser.USERID.ToString(),
                        UserName = mUser.USERNAME,
                        Expires = DateTime.Now.AddMinutes(20)
                    }.Login();
                    return true;
                }

            }
            var falg = !string.IsNullOrEmpty(LoginSysUser.GetId());
            if (!falg)
                context.Response.StatusCode = 403;
            return falg;
        }

        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            base.HandleUnauthorizedRequest(filterContext);
            if (filterContext.HttpContext.Response.StatusCode == 403)
            {
                if (filterContext.HttpContext.Request.Url != null)
                {
                    if (filterContext.HttpContext.Request.IsAjaxRequest())
                    {
                        var result = new JsonResult
                        {
                            Data = new
                            {
                                Code = -1,
                                Message = "請先登錄！"
                            },
                            JsonRequestBehavior = JsonRequestBehavior.AllowGet
                        };
                        filterContext.Result = result;
                    }
                    else
                    {
                        filterContext.Result = new RedirectResult("~/Sys/Account/Login");
                    }
                }
            }
        }

        #endregion Methods
    }

2. 添加AuthorizeAttribute過濾

我們自定義個AthorizeAttribute已經實現了，接下來就是在控制器上面實現了。具體實現方法有三種

1、Controller層級添加

 

 2、Action層級添加

 

 3、全局添加（這個過濾器配置可以在Global.asax中看到）

 

 

四、取消過濾

 　　　　　有些頁面，例如登錄頁面、登錄請求的時候用戶是肯定還沒有登錄的，這個時候如果我用了全局添加的話，用戶豈不是永遠無法登錄了？那么為了使某些特定的方法可以不用驗證過濾可以在特定Action、Controller上面添加以下抬頭

 

 AllowAonymous表示一個特性，該特性用於標記在授權期間要跳過 System.Web.Mvc.AuthorizeAttribute 的控制器和操作