自定义属性 +使用查询字符串验证权限？

Question

我网站的某个部分检查登录用户是否可以访问记录的 ID（报告 ID），如果可以，他们可以查看该页面上的内容。可以有各种不同类型的用户/公司查看内容。

编写检查用户是否可以访问 id 的自定义属性的最佳实践是什么？我应该传入查询字符串吗？请注意，id 将来自路由/url。

例如，报告 ID = 678。 urls:

• /Report/678/Detail
• /Report/678/Progress/Staging
• /Report/678/TaskManager/78/
• /Report/678/Participants

使用下面的代码

[ReportAuthorizationAttribute ())] //get query string yourself
[ReportAuthorizationAttribute (Request.Querystring["reportid"))] //this does not look possible to do???

//将添加到基本控制器的代码< /strong> 该区域

public class ReportAuthorizationAttribute : AuthorizeAttribute
{

    /// <summary>
    /// inject via Ninject - there must be a better way? Using service locator?
    /// </summary>
    [Inject]
    public readonly IReportRepo _repo { get; set; }
    [Inject]
    public readonly IUserSession _user { get; set; }

    private int _reportid;

    public ReportAuthorizationAttribute()
        : base()
    { //*Is this way the best way?*
     _reportid= Int32.Parse(HttpContext.Current.Request.QueryString["reportid"]);
    }

    public ReportAuthorizationAttribute(params int reportid)
        : base()
    {
        _reportid = reportid;
    }

    public ReportAuthorizationAttribute(params string reportid)
        : base()
    {
        _reportid= Int32.Parse(reportid);
    }


    public bool AlwaysAllowLocalRequests = false;


    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {

        if (httpContext == null)
            throw new NoAccessException("httpContext is null");

        if (!httpContext.User.Identity.IsAuthenticated)
            throw new NoAccessException("unauthorized user");

        var companyid = _user.GetCurrentUser().CompanyID;
        if (AlwaysAllowLocalRequests && _repo.IsCompanyParticipantInReport(_reportid, companyid))
            return true;

        return false;
    }


}

Answer 1

//这是最好的方式吗？

_reportid= Int32.Parse(HttpContext.Current.Request.QueryString["reportid"]);

如果您使用路由，reportid 不会成为查询字符串的一部分。您需要从路由中获取它：

var reportId = filterContext.RequestContext.RouteData.Values["reportId"];

也不要在操作过滤器构造函数中使用 HttpContext.Current。仅在 AuthorizeCore 方法内使用它：

public class ReportAuthorizationAttribute : AuthorizeAttribute
{
    [Inject]
    public readonly IReportRepo _repo { get; set; }

    [Inject]
    public readonly IUserSession _user { get; set; }

    public bool AlwaysAllowLocalRequests = false;

    private string _reportId;

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        _reportId = filterContext.RequestContext.RouteData.Values["reportId"] as string;
        base.OnAuthorization(filterContext);
    }

    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        if (httpContext == null)
            return false;

        if (!httpContext.User.Identity.IsAuthenticated)
            return false;

        int reportId;
        if (!int.TryParse(_reportId, out reportId))
            return false;

        var companyid = _user.GetCurrentUser().CompanyID;
        return AlwaysAllowLocalRequests && 
               _repo.IsCompanyParticipantInReport(reportId, companyid));
    }
}