ASP.Net MVC 3 中基于数据的权利/授权
我的谷歌技能在这方面让我失败。我正在寻找在 ASP.Net MVC (3) 中执行基于数据的权利的“正确方法”。
对于常规权利，人们只需要知道用户和路线就可以使用 [Authorize] 属性来完成，但这似乎不适用于基于数据的权利，因为需要与数据存储有连接。
在操作方法中插入检查的明显方法是否正确？
My google skills are failing me on this. I'm looking for the "right way" to do data based entitlements in ASP.Net MVC (3).
With regular entitlements where one just need to know the user and the route can be done with the [Authorize] attribute, but this doesn't appear to work with data based entitlements b/c of the need to have a connection to the data store.
Is the obvious approach of inserting a check into the action methods the right way?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这就是我所做的。
这是迄今为止最简单的方法。
为了确保您只需执行一次“userHasAuthorization”，您可以在存储库或服务层中放置一个方法来检查授权，并使用该方法代替布尔值
userHasAuthorization。That's what I do.
It's by far the simplest way.
To make sure you only have to do "userHasAuthorization" once, you can put a method in your repository or service layer that checks for authorization, and use that in place of the boolean value
userHasAuthorization.不知道什么是“基于数据的权利”。我确实相信自定义操作过滤器会让您得到您想要的。这使您可以通过路由、用户等上下文来管理授权所需的任何内容。提供更细粒度的控制。还为您提供了可重用性，因此您无需将 if 语句插入到您的操作方法中。
http://msdn.microsoft.com/en-us/library/dd381609.aspx
Without knowing what "data based entitlements" are. I do believe that custom action filters will get you what you want. This lets you manage whatever you need around authorization with having the context of the route, user, etc. Gives more fine grained control. Also gives you the re usability so you dont need to plug if statements into your action methods.
http://msdn.microsoft.com/en-us/library/dd381609.aspx
您可以创建一个派生自
[Authorize]属性的自定义操作过滤器，该属性使用数据存储来检查授权。You could create a custom action filter derived from the
[Authorize]attribute that uses the data store to check authorization.