我有一个ASP.NET MVC中的控制器，我已经将其限制为管理员角色：
[Authorize(Roles = "Admin")]
public class TestController : Controller
{
...
如果一个非管理员角色的用户导航到这个控制器，他们会看到一个空白屏幕。
我想要做的是将其重定向到一个视图，上面写着“您需要成为管理员才能访问此资源。”
我想到的一种实现方式是在每个动作方法中检查IsUserInRole()方法，如果不在该角色中，则返回此信息视图。但是，这会违反DRY原则，显然很难维护。
编辑：我有几篇关于此主题更详细的博客文章：
示例：
[AttributeUsage( AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false )]
public class MasterEventAuthorizationAttribute : AuthorizeAttribute
{
/// <summary>
/// The name of the master page or view to use when rendering the view on authorization failure. Default
/// is null, indicating to use the master page of the specified view.
/// </summary>
public virtual string MasterName { get; set; }
/// <summary>
/// The name of the view to render on authorization failure. Default is "Error".
/// </summary>
public virtual string ViewName { get; set; }
public MasterEventAuthorizationAttribute()
: base()
{
this.ViewName = "Error";
}
protected void CacheValidateHandler( HttpContext context, object data, ref HttpValidationStatus validationStatus )
{
validationStatus = OnCacheAuthorization( new HttpContextWrapper( context ) );
}
public override void OnAuthorization( AuthorizationContext filterContext )
{
if (filterContext == null)
{
throw new ArgumentNullException( "filterContext" );
}
if (AuthorizeCore( filterContext.HttpContext ))
{
SetCachePolicy( filterContext );
}
else if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
{
// auth failed, redirect to login page
filterContext.Result = new HttpUnauthorizedResult();
}
else if (filterContext.HttpContext.User.IsInRole( "SuperUser" ))
{
// is authenticated and is in the SuperUser role
SetCachePolicy( filterContext );
}
else
{
ViewDataDictionary viewData = new ViewDataDictionary();
viewData.Add( "Message", "You do not have sufficient privileges for this operation." );
filterContext.Result = new ViewResult { MasterName = this.MasterName, ViewName = this.ViewName, ViewData = viewData };
}
}
protected void SetCachePolicy( AuthorizationContext filterContext )
{
// ** IMPORTANT **
// Since we're performing authorization at the action level, the authorization code runs
// after the output caching module. In the worst case this could allow an authorized user
// to cause the page to be cached, then an unauthorized user would later be served the
// cached page. We work around this by telling proxies not to cache the sensitive page,
// then we hook our custom authorization code into the caching mechanism so that we have
// the final say on whether a page should be served from the cache.
HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
cachePolicy.SetProxyMaxAge( new TimeSpan( 0 ) );
cachePolicy.AddValidationCallback( CacheValidateHandler, null /* data */);
}
}
你可以在自定义的 AuthorizeAttribute 中使用可重写的 HandleUnauthorizedRequest。
像这样:
protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
// Returns HTTP 401 by default - see HttpUnauthorizedResult.cs.
filterContext.Result = new RedirectToRouteResult(
new RouteValueDictionary
{
{ "action", "YourActionName" },
{ "controller", "YourControllerName" },
{ "parameterName", "YourParameterValue" }
});
}
你也可以像这样做：
private class RedirectController : Controller
{
public ActionResult RedirectToSomewhere()
{
return RedirectToAction("Action", "Controller");
}
}
现在你可以这样在你的HandleUnauthorizedRequest方法中使用它：
filterContext.Result = (new RedirectController()).RedirectToSomewhere();
"tvanfosson"的代码给了我“Error executing Child Request”错误。 我已将OnAuthorization更改为：
public override void OnAuthorization(AuthorizationContext filterContext)
{
base.OnAuthorization(filterContext);
if (!_isAuthorized)
{
filterContext.Result = new HttpUnauthorizedResult();
}
else if (filterContext.HttpContext.User.IsInRole("Administrator") || filterContext.HttpContext.User.IsInRole("User") || filterContext.HttpContext.User.IsInRole("Manager"))
{
// is authenticated and is in one of the roles
SetCachePolicy(filterContext);
}
else
{
filterContext.Controller.TempData.Add("RedirectReason", "You are not authorized to access this page.");
filterContext.Result = new RedirectResult("~/Error");
}
}
这很有效，我可以在错误页面上显示TempData。感谢“tvanfosson”提供的代码片段。我正在使用Windows身份验证，而_isAuthorized不过是HttpContext.User.Identity.IsAuthenticated的别名...
我有同样的问题。与其弄清楚MVC代码，我选择了一个似乎可以起作用的便宜小技巧。在我的Global.asax类中：
member x.Application_EndRequest() =
if x.Response.StatusCode = 401 then
let redir = "?redirectUrl=" + Uri.EscapeDataString x.Request.Url.PathAndQuery
if x.Request.Url.LocalPath.ToLowerInvariant().Contains("admin") then
x.Response.Redirect("/Login/Admin/" + redir)
else
x.Response.Redirect("/Login/Login/" + redir)
filterContext.Result = new HttpUnauthorizedResult();
在我的情况下，我继承自一个基础控制器，所以在每个继承它的控制器中，我都要重写OnAuthorize：
protected override void OnAuthorization(AuthorizationContext filterContext)
{
base.OnAuthorization(filterContext);
YourAuth(filterContext); // do your own authorization logic here
}
问题出在'YourAuth'中，我尝试了两种方法，认为这不仅可以奏效，还能立即终止请求。然而，事实并非如此。因此，首先介绍两种行不通的方法：
filterContext.RequestContext.HttpContext.Response.Redirect("/Login"); // doesn't work!
FormsAuthentication.RedirectToLoginPage(); // doesn't work!
不仅这些方法无效，而且它们也不能结束请求。这意味着以下内容：
if (!success) {
filterContext.Result = new HttpUnauthorizedResult();
}
DoMoreStuffNowThatYouThinkYourAuthorized();
但是，使用正确的答案后，尽管OnAuthorize的逻辑流仍将一直持续到结束，但在那之后，你确实会得到你期望的结果：重定向到登录页面（如果你在webconfig的Forms auth中设置了一个登录页面）。
但出乎意料的是， 1）Response.Redirect("/Login")不起作用：Action方法仍然被调用，而 2）FormsAuthentication.RedirectToLoginPage();也是同样的情况：Action方法仍然被调用！
这对我来说似乎完全错误，特别是后者：谁会想到FormsAuthentication.RedirectToLoginPage不会结束请求或执行filterContext.Result = new HttpUnauthorizedResult()的等效操作？
<httpErrors>
<remove statusCode="401" />
<error statusCode="401" path="/yourapp/error/unauthorized" responseMode="Redirect" />
</httpErrors>
你应该构建自己的授权过滤器属性。
这是我的供你学习 ;)
Public Class RequiresRoleAttribute : Inherits ActionFilterAttribute
Private _role As String
Public Property Role() As String
Get
Return Me._role
End Get
Set(ByVal value As String)
Me._role = value
End Set
End Property
Public Overrides Sub OnActionExecuting(ByVal filterContext As System.Web.Mvc.ActionExecutingContext)
If Not String.IsNullOrEmpty(Me.Role) Then
If Not filterContext.HttpContext.User.Identity.IsAuthenticated Then
Dim redirectOnSuccess As String = filterContext.HttpContext.Request.Url.AbsolutePath
Dim redirectUrl As String = String.Format("?ReturnUrl={0}", redirectOnSuccess)
Dim loginUrl As String = FormsAuthentication.LoginUrl + redirectUrl
filterContext.HttpContext.Response.Redirect(loginUrl, True)
Else
Dim hasAccess As Boolean = filterContext.HttpContext.User.IsInRole(Me.Role)
If Not hasAccess Then
Throw New UnauthorizedAccessException("You don't have access to this page. Only " & Me.Role & " can view this page.")
End If
End If
Else
Throw New InvalidOperationException("No Role Specified")
End If
End Sub
End Class
filterContext.Result = new RedirectResult(loginUrl)，而不是进行重定向。 - Mike Cole我原本想将这个留言作为评论，但是我需要更多的声望。无论如何，我只是想提醒Nicholas Peterson，也许将第二个参数传递给Redirect调用以告诉它结束响应可能会起作用。虽然这不是最优雅的处理方式，但确实可以解决问题。
所以
filterContext.RequestContext.HttpContext.Response.Redirect("/Login", true);
filterContext.RequestContext.HttpContext.Response.Redirect("/Login);
So you'd have this in your controller:
protected override void OnAuthorization(AuthorizationContext filterContext)
{
if(!User.IsInRole("Admin")
{
base.OnAuthorization(filterContext);
filterContext.RequestContext.HttpContext.Response.Redirect("/Login", true);
}
}