摘要：mvc 過(guò)濾器結(jié)構(gòu)圖AuthorizeAttributeAuthorizeAttribute是IAuthorizationFilter的默認(rèn)實(shí)現(xiàn),添加了Authorize特性的Action將對(duì)用戶進(jìn)行驗(yàn)證授權(quán),只有通過(guò)了用戶才可以進(jìn)入這個(gè)Action.AuthorizeAttribute提供了四種操作方法,打開(kāi).net reflector查看源碼1.在進(jìn)入Action之前首先執(zhí)行OnAuthori
mvc 過(guò)濾器結(jié)構(gòu)圖
AuthorizeAttribute
AuthorizeAttribute是IAuthorizationFilter的默認(rèn)實(shí)現(xiàn),添加了Authorize特性的Action將對(duì)用戶進(jìn)行驗(yàn)證授權(quán),只有通過(guò)了用戶才可以進(jìn)入這個(gè)Action.
AuthorizeAttribute提供了四種操作方法,打開(kāi).net reflector查看源碼
1.在進(jìn)入Action之前首先執(zhí)行OnAuthorization
public virtual void OnAuthorization(AuthorizationContext filterContext)
{
if (filterContext == null)
{
throw new ArgumentNullException("filterContext");
}
if (OutputCacheAttribute.IsChildActionCacheActive(filterContext))
{
throw new InvalidOperationException(MvcResources.AuthorizeAttribute_CannotUseWithinChildActionCache);
}
if (!filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true) && !filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), true))
{
if (this.AuthorizeCore(filterContext.HttpContext))
{
HttpCachePolicyBase cache = filterContext.HttpContext.Response.Cache;
cache.SetProxyMaxAge(new TimeSpan(0L));
cache.AddValidationCallback(new HttpCacheValidateHandler(this.CacheValidateHandler), null);
}
else
{
this.HandleUnauthorizedRequest(filterContext);
}
}
}2.在OnAuthorization內(nèi)部會(huì)調(diào)用AuthorizeCore
protected virtual bool AuthorizeCore(HttpContextBase httpContext)
{
if (httpContext == null)
{
throw new ArgumentNullException("httpContext");
}
IPrincipal user = httpContext.User;
if (!user.Identity.IsAuthenticated)
{
return false;
}
if ((this._usersSplit.Length > 0) && !this._usersSplit.Contains<string>(user.Identity.Name, StringComparer.OrdinalIgnoreCase))
{
return false;
}
if ((this._rolesSplit.Length > 0) && !this._rolesSplit.Any<string>(new Func<string, bool>(user.IsInRole)))
{
return false;
}
return true;
}默認(rèn)實(shí)現(xiàn),不僅判斷是否授權(quán),還可以具體到某一個(gè)角色,某一個(gè)用戶,但這些角色是哪里來(lái)的呢?
(1)使用membership框架
(2)使用微軟最新的Identity框架
(3)自定義一個(gè)類繼承RoleProvider,并設(shè)置配置文件
<roleManager> <providers> <clear/> <add name="MyRoleProvider" type="Filter.Controllers.MyRoleProvider" /> </providers> </roleManager>
3.AuthorizeCore返回一個(gè)布爾值,表示是否通過(guò)授權(quán),未通過(guò)將執(zhí)行HandUnauthorizedRequest返回配置文件forms-loginUrl指向的頁(yè)面
protected virtual void HandleUnauthorizedRequest(AuthorizationContext filterContext)
{
filterContext.Result = new HttpUnauthorizedResult();
}4.OnAuthorization在緩存模塊請(qǐng)求授權(quán)時(shí)調(diào)用
protected virtual HttpValidationStatus OnCacheAuthorization(HttpContextBase httpContext)
{
if (httpContext == null)
{
throw new ArgumentNullException("httpContext");
}
if (!this.AuthorizeCore(httpContext))
{
return HttpValidationStatus.IgnoreThisRequest;
}
return HttpValidationStatus.Valid;
}ActionFilterAttribute
ActionFilterAttribute在mvc中沒(méi)有默認(rèn)實(shí)現(xiàn),需要自己定義
1.OnActionExecuting在OnAuthorization之后(實(shí)際上ActionFilter中的方法都在其之后)進(jìn)入Action之前執(zhí)行
2.OnActionExecuted在Action中所有語(yǔ)句都執(zhí)行完之后執(zhí)行
3.OnResultExecuting在執(zhí)行操作結(jié)果(返回繼承自ActionResult的所有類型)前調(diào)用
4.OnResultExecuted在執(zhí)行操作結(jié)果(返回繼承自ActionResult的所有類型)后調(diào)用
public class MyActionFilterAttribute : ActionFilterAttribute
{
/// <summary>
/// 在執(zhí)行操作方法之前由 ASP.NET MVC 框架調(diào)用。
/// </summary>
/// <param name="filterContext"></param>
public override void OnActionExecuting(ActionExecutingContext filterContext)
{
}
/// <summary>
/// 在執(zhí)行操作方法后由 ASP.NET MVC 框架調(diào)用。
/// </summary>
/// <param name="filterContext"></param>
public override void OnActionExecuted(ActionExecutedContext filterContext)
{
}
/// <summary>
/// 在執(zhí)行操作結(jié)果之前由 ASP.NET MVC 框架調(diào)用。
/// </summary>
/// <param name="filterContext"></param>
public override void OnResultExecuting(ResultExecutingContext filterContext)
{
}
/// <summary>
/// 在執(zhí)行操作結(jié)果后由 ASP.NET MVC 框架調(diào)用。
/// </summary>
/// <param name="filterContext"></param>
public override void OnResultExecuted(ResultExecutedContext filterContext)
{
}
}HandleErrorAttribute
HandleErrorAttribute是IException的默認(rèn)實(shí)現(xiàn),在調(diào)式的時(shí)候,出現(xiàn)異常就會(huì)蹦出那黃色的頁(yè)面
我們也可以自定義異常處理
需要注意的是ExceptionHandled表示這個(gè)異常是否已經(jīng)處理(可能程序中有多個(gè)異常過(guò)濾器)
public class MyExceptionAttribute : HandleErrorAttribute
{
public override void OnException(ExceptionContext filterContext)
{
if (!filterContext.ExceptionHandled)//避免重復(fù)處理
{
//獲取拋出異常的對(duì)象
Exception ex = filterContext.Exception;
//寫(xiě)入異常日志
//已處理
filterContext.ExceptionHandled = false;
}
}
}IAuthenticationFilter
IAuthenticationFilter是認(rèn)證過(guò)濾器接口,他提供了兩個(gè)操作方法
1.OnAuthentication在所有過(guò)濾器執(zhí)行前執(zhí)行(包括授權(quán)過(guò)濾器)
2.OnAuthenticationChallenge在OnResultExecuting前執(zhí)行