自定义授权属性

Question

我正在实现 CustomAuthorizeAttribute。我需要获取正在执行的操作的名称。如何获取在我要重写的 AuthorizeCore 函数中执行的当前操作名称的名称？

Answer 1

如果您正在使用缓存（或计划使用），则覆盖 AuthorizeCore，就像 Darin Dimitrov 在 这个答案是一个更安全的选择：

protected override bool AuthorizeCore(HttpContextBase httpContext)
{
    var routeData = httpContext.Request.RequestContext.RouteData;
    var controller = routeData.GetRequiredString("controller");
    var action = routeData.GetRequiredString("action");
    ...
}

其原因记录在 MVC 源代码本身：

AuthorizeAttribute.cs（行72-101）

public virtual void OnAuthorization(AuthorizationContext filterContext) {
    if (filterContext == null) {
        throw new ArgumentNullException("filterContext");
    }

    if (OutputCacheAttribute.IsChildActionCacheActive(filterContext)) {
        // If a child action cache block is active, we need to fail immediately, even if authorization
        // would have succeeded. The reason is that there's no way to hook a callback to rerun
        // authorization before the fragment is served from the cache, so we can't guarantee that this
        // filter will be re-run on subsequent requests.
        throw new InvalidOperationException(MvcResources.AuthorizeAttribute_CannotUseWithinChildActionCache);
    }

    if (AuthorizeCore(filterContext.HttpContext)) {
        // ** IMPORTANT **
        // Since we're performing authorization at the action level, the authorization code runs
        // after the output caching module. In the worst case this could allow an authorized user
        // to cause the page to be cached, then an unauthorized user would later be served the
        // cached page. We work around this by telling proxies not to cache the sensitive page,
        // then we hook our custom authorization code into the caching mechanism so that we have
        // the final say on whether a page should be served from the cache.

        HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
        cachePolicy.SetProxyMaxAge(new TimeSpan(0));
        cachePolicy.AddValidationCallback(CacheValidateHandler, null /* data */);
    }
    else {
        HandleUnauthorizedRequest(filterContext);
    }
}

即使您不打算使用缓存，这两个神奇的字符串似乎也只是为了让您安心而付出的小代价（以及您自己避免的潜在麻烦。）如果您仍然想覆盖OnAuthorization 相反，您至少应该确保请求没有被缓存。有关更多背景信息，请参阅 Levi 的这篇文章。

Answer 2

您可以像这样获取操作名称：

public class CustomAuthFilter : IAuthorizationFilter
    {
        public void OnAuthorization(AuthorizationContext filterContext)
        {
            filterContext.ActionDescriptor.ActionName;
        }
    }

编辑：

如果您想从 AuthorizationAttribute 继承，则需要重写 OnAuthorization 方法。

public class CustomAuthAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);
    }
}