对于 asp.net mvc 中的身份验证非常非常困惑

我得出的结论是我需要放弃 ASP.NETMembership（列出原因）。

现在我发现我唯一需要的就是创建一个cookie（由Form Authentication），用于身份验证的自定义方法（完成），最后根据是否登录或按角色进行验证。

我被困在最后一个。

我正在尝试覆盖Authorize（属性）但我不知道如何做到这一点。我看了很多例子，每个例子的做法似乎都与下一个不同。我不知道他们为什么这样做，也不知道我应该使用哪一个。

有些教程似乎在进行身份验证AuthorizeCore，有些这样做是在OnAuthentication.

有的用一些AuthorizationContext然后调用这个基类。

base.OnAuthorization(filterContext);

有些似乎在其中进行缓存。

我想要的是内置功能具有的所有功能，但只是连接到我的自定义表格。就像我将拥有自己的角色表一样。我需要告诉它那在哪里，然后把东西拉进去。

我也不知道如何做到这一点或如何像这样装饰标签

[Authorize(Roles="test")]

参考：-http://darioquintana.com.ar/blogging/tag/aspnet-mvc/ http://darioquintana.com.ar/blogging/tag/aspnet-mvc/ asp.net mvc 添加 AUTHORIZE 属性 https://stackoverflow.com/questions/554094/asp-net-mvc-adding-to-the-authorize-attribute http://davidhayden.com/blog/dave/archive/2009/04/09/CustomAuthorizationASPNETMVCFrameworkAuthorizeAttribute.aspx http://davidhayden.com/blog/dave/archive/2009/04/09/CustomAuthorizationASPNETMVCFrameworkAuthorizeAttribute.aspx

Edit

这就是我现在所拥有的。

[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
    public sealed class AuthorizeAttributeCustom : AuthorizeAttribute
    {

        public string Roles { get; set; }


        private void CacheValidateHandler(HttpContext context, object data, ref HttpValidationStatus validationStatus)
        {
            validationStatus = OnCacheAuthorization(new HttpContextWrapper(context));
        }

        public override void OnAuthorization(AuthorizationContext filterContext)
        {

            if (filterContext == null)
            {
                throw new ArgumentNullException("filterContext");
            }

            if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
                // auth failed, redirect to login page
                filterContext.Result = new HttpUnauthorizedResult();
                return;
            }

            DataClasses1DataContext test = new DataClasses1DataContext();
            var name = filterContext.HttpContext.User.Identity.Name;
            var user = test.User2s.Where(u => u.userName == name).FirstOrDefault();
            var role = test.Roles.Where(u => u.UserId == user.userId).Select(u => u.Role1).FirstOrDefault();

            string[] split = Roles.Split(',');

            if (split.Contains(role) == true)
            {
                // is authenticated and is in the required role
                SetCachePolicy(filterContext);
                return;
            }
            filterContext.Result = new HttpUnauthorizedResult();
        }

        private void SetCachePolicy(AuthorizationContext filterContext)
        {
            // ** IMPORTANT **
            // Since we're performing authorization at the action level, the authorization code runs
            // after the output caching module. In the worst case this could allow an authorized user
            // to cause the page to be cached, then an unauthorized user would later be served the
            // cached page. We work around this by telling proxies not to cache the sensitive page,
            // then we hook our custom authorization code into the caching mechanism so that we have
            // the final say on whether a page should be served from the cache.
            HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
            cachePolicy.SetProxyMaxAge(new TimeSpan(0));
            cachePolicy.AddValidationCallback(CacheValidateHandler, null /* data */);
        }
    }

悬而未决的问题

1. 为什么会被密封呢？如果是密封的 这不是让团结变得更加困难吗 测试？
2. 什么是filterContext？
3. 为什么没有使用AuthorizeCore？仅有的 身份验证？

4. 缓存指的是什么？喜欢 它缓存角色吗？还是页面？ 我无法用调试器判断它 似乎每次都运行代码 时间。

5. 缓存安全吗？

6. 一般来说这是安全的（即没有漏洞 被利用——有点担心 我会把事情搞砸并拥有 我网站上的一些主要漏洞）。

这是一个可以按照您想要的方式工作的自定义属性；使用枚举作为角色类型并使用自己创建 cookie，这允许存储角色。

usage

  [AuthorizeAttributeCustom(RoleRequired = GoodRoles.YourRoleTypeHere)]

属性代码：

//http://stackoverflow.com/questions/977071/redirecting-unauthorized-controller-in-asp-net-mvc/977112#977112
    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = false)]
    public sealed class AuthorizeAttributeCustom : AuthorizeAttribute
    {

        /// <summary>
        /// The name of the view to render on authorization failure.  Default is "Error".
        /// </summary>
        public string ViewName { get; set; }
        public ViewDataDictionary ViewDataDictionary { get; set; }
        public DeniedAccessView DeniedAccessView { get; set; }

        private GoodRoles roleRequired = GoodRoles.None;
        public GoodRoles RoleRequired { get{ return roleRequired;} set{ roleRequired = value;} } // this may evolve into sets and intersections with an array but KISS

        public AuthorizeAttributeCustom()
        {
            ViewName = "DeniedAccess";
            DeniedAccessView = new DeniedAccessView
                                   {
                                       FriendlyName = "n/a",
                                       Message = "You do not have sufficient privileges for this operation."
                                   };
            ViewDataDictionary = new ViewDataDictionary(DeniedAccessView);
        }

        private void CacheValidateHandler(HttpContext context, object data, ref HttpValidationStatus validationStatus)
        {
            validationStatus = OnCacheAuthorization(new HttpContextWrapper(context));
        }


        public override void OnAuthorization(AuthorizationContext filterContext)
        {

            if (filterContext == null)
            {
                throw new ArgumentNullException("filterContext");
            }

            if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
            {
                // auth failed, redirect to login page
                filterContext.Result = new HttpUnauthorizedResult();
                return;
            }

            if (RoleRequired == GoodRoles.None || filterContext.HttpContext.User.IsInRole(RoleRequired.ToString()))
            {
                // is authenticated and is in the required role
                SetCachePolicy(filterContext);
                return;
            }

            filterContext.Result = new ViewResult { ViewName = ViewName, ViewData = ViewDataDictionary };
        }

        private void SetCachePolicy(AuthorizationContext filterContext)
        {
            // ** IMPORTANT **
            // Since we're performing authorization at the action level, the authorization code runs
            // after the output caching module. In the worst case this could allow an authorized user
            // to cause the page to be cached, then an unauthorized user would later be served the
            // cached page. We work around this by telling proxies not to cache the sensitive page,
            // then we hook our custom authorization code into the caching mechanism so that we have
            // the final say on whether a page should be served from the cache.
            HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
            cachePolicy.SetProxyMaxAge(new TimeSpan(0));
            cachePolicy.AddValidationCallback(CacheValidateHandler, null /* data */);
        }


    }

您需要将您的角色明确添加到 auth cookie 中，并在基本控制器中读回它们。我的实现还有其他您可能不想要的细节，所以最好在这里阅读：http://ondotnet.com/pub/a/dotnet/2004/02/02/ effectiveformsauth.html http://ondotnet.com/pub/a/dotnet/2004/02/02/effectiveformsauth.html