在 ASP.NET MVC 应用程序中实现精细安全性（即授权）的最佳机制是什么？
假设一位高速开发人员的任务是构建一个可供许多不同人访问的银行应用程序。每个人都希望访问自己的帐户信息，但不希望其他人访问它。我想知道在 MVC 应用程序中限制访问的最佳实践，以便只有拥有该信息的用户（或管理员）才能访问它。
Authorize 属性允许我们按角色进行限制。虽然这是一个起点，但似乎任何经过身份验证的用户都可以访问任何其他用户的信息。
ActionFilters 似乎提供了更精细控制的选项，并且可能用于完成该任务。但是，我不清楚它们是否是推荐的方法。
欢迎任何指导或想法。
Suppose a high-speed developer was tasked with building a banking application which would be accessed by many different people. Each person would want to access his or her own account information but would not want others to access it. I would like to know the best practice for restricting access in an MVC application so that only the user who owns the information (or an administrator) could access it.
The Authorize attribute allows us to restrict by role. While this is a starting point, it seems that any authenticated user could gain access to any other user's information.
ActionFilters seem to offer the option for a little more granular control and could probably be used to accomplish the task. However, I am unclear as to whether they would be the recommended approach.
Any guidance or ideas are welcome.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
ActionFilter 可能是一个很好的起点，但根据您的架构，您可能需要考虑外围防御是否足够好。
如果您本质上是构建一个单层 ASP.NET MVC 应用程序（并且可能有完全合理的理由这样做），则 ActionFilter 将提供足够好的防御，同时非常易于应用。
另一方面，如果您的应用程序是多层应用程序，则深度防御更合适。在这种情况下，您应该考虑在域模型中应用授权逻辑，甚至在数据访问层中应用授权逻辑。这将确保如果您开发基于相同域模型的另一个应用程序（例如 Web 服务），授权逻辑仍然适用。
无论你做什么，我强烈建议你将实际的授权实现基于IPrincipal。
更具体地说，您在这里询问的内容最好使用基于 ACL 的授权进行建模：在每个用户配置文件上设置 ACL，默认情况下仅向用户本人和管理员授予访问权限。如果/当您稍后需要扩展应用程序以允许对其他用户的配置文件进行委派访问时（我不知道这在您的具体情况下是否遥远），您可以通过向 ACL 添加新条目来简单地做到这一点。
在这种情况下，评估访问权限涉及检索所请求资源的 ACL 并检查当前用户 (IPrincipal) 是否包含在该 ACL 中。此类操作很可能涉及进程外操作（在数据库中查找 ACL），因此通过将其隐藏在 ActionFilter 后面来将其作为应用程序的隐式部分，听起来可能会隐藏一些性能问题。在这种情况下，我会考虑使授权模型更加明确/可见。
ActionFilter is probably a good starting point, but depending on your architecture, you may want to consider whether perimeter defense is good enough.
If you are essentially building a single-layer ASP.NET MVC application (and there may be perfectly reasonable reasons to do this), an ActionFilter will provide defense that is good enough while at the same time being very simply to apply.
On the other hand, if your application is a multi-layer application, Defense in Depth is more appropriate. In that case, you should consider applying the authorization logic in the Domain Model, or perhaps even in the Data Access layer. This will ensure that if you ever develop another application based on the same Domain Model (e.g. a web service), the authorization logic would still apply.
No matter what you do, I strongly recommend that you base the actual authorization implementation on IPrincipal.
On a more specific note, what you are asking about here is best modeled with ACL-based authorization: Set an ACL on each user profile that by default grants access to only the user him/herself and the administrator. If/when you later need to expand the application to allow delegated access to other users' profiles (I don't know whether that's even remotely realistic in your specific case), you can simply do that by adding a new entry to the ACL.
In such a case, evaluating access involves retrieving the ACL for the requested resource and checking whether the current user (IPrincipal) is included in that ACL. Such an operation is very likely to involve out-of-process operations (looking up the ACL in a database), so having it as an implicit part of an application by hiding it behind an ActionFilter sounds like it could potentially hide some performance issues. In such a case, I would consider making the authorization model a bit more explict/visible.
根据我的观点，如果您有单层应用程序，那么授权是最好的选择，而且 actionfilter 更好且更易于使用。但如果您的应用程序是多层的，那么您必须使用访问控制列表 [ACL]。
According to my view if you have single layer application then authorization is best option and also actionfilter is much better and simpler to use. But if your application is multilayer then you Mus USE Access Control list [ACL].
我认为你说得对，ActionFilter 方法是一种合理的方法。
我将创建一组继承自 AuthorizeAttribute 的自定义操作过滤器。
除了授权属性的功能之外，您还可以干净地实施更严格的仅限所有者策略。
HTH，
丹
I think you have it about right, the ActionFilter approach is a sound one.
I'd create a set of custom action filters that inherited from AuthorizeAttribute.
In addition to the funnctionality of the Authorize attribute you could implement a more stringent owner only policy cleanly.
HTH,
Dan
如果您想要外部化授权，您可以查看基于 XACML 的实现。
If you ever want to externalize authorization you can take a look at XACML based implementations.