拒絕自定義角色

Question

如何拒絕訪問調用方法。像這樣的東西

[HandleError] 
    [Authorize(Roles = "role1, role2")] 
    public class AdminController : Controller 
    {   


     [Deny(Roles = "role2")] 
     public ActionResult ResultPage(string message) 
     { 
      ViewData["message"] = message; 
      return View(); 
     } 
} 

Answer 1

你可以簡單地做，反過來檢查是否存在role1而不是沒有role2。或者，您可以開發自己的DenyAttribute，它可以執行您想要的操作並驗證用戶是否不在指定的角色中。

[HandleError] 
[Authorize(Roles = "role1, role2")] 
public class AdminController : Controller 
{   


    [Authorize(Roles = "role1")] 
    public ActionResult ResultPage(string message) 
    { 
     ViewData["message"] = message; 
     return View(); 
    } 
} 

public class DenyAttribute : AuthorizeAttribute 
{ 

    protected override bool AuthorizeCore(HttpContextBase httpContext) { 
     if (httpContext == null) { 
      throw new ArgumentNullException("httpContext"); 
     } 

     IPrincipal user = httpContext.User; 
     if (!user.Identity.IsAuthenticated) { 
      return false; 
     } 

     if (Users.Length > 0 && Users.Split(',').Any(u => string.Compare(u.Trim(), user.Identity.Name, StringComparer.OrdinalIgnoreCase))) { 
      return false; 
     } 

     if (Roles.Length > 0 && Roles.Split(',').Any(u => user.IsInRole(u.Trim()))) { 
      return false; 
     } 

     return true; 
    } 

}