using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;namespace LoginDemo.CustomAttributes
{public static class Roles{public const string DIRECTOR = "DIRECTOR";public const string SUPERVISOR = "SUPERVISOR";public const string ANALYST = "ANALYST";}
}

让我们向用户集合添加“写”权限。

//Using hard coded collection list as Data Store for demo purpose.
//In reality, User data comes from Database or some other Data Source - JRozario
private List UserList = new List
{new User { USERID = "jsmith@email.com", PASSWORD = "test", EMAILID = "jsmith@email.com", FIRST_NAME = "John", LAST_NAME = "Smith", PHONE = "356-735-2748", ACCESS_LEVEL = Roles.DIRECTOR.ToString(), WRITE_ACCESS = "WRITE_ACCESS" },new User { USERID = "srob@email.com", PASSWORD = "test", FIRST_NAME = "Steve", LAST_NAME = "Rob", EMAILID = "srob@email.com", PHONE = "567-479-8537", ACCESS_LEVEL = Roles.SUPERVISOR.ToString(), WRITE_ACCESS = "WRITE_ACCESS" },new User { USERID = "dwill@email.com", PASSWORD = "test", FIRST_NAME = "DJ", LAST_NAME = "Will", EMAILID = "dwill@email.com", PHONE = "599-306-6010", ACCESS_LEVEL = Roles.ANALYST.ToString(), WRITE_ACCESS = "WRITE_ACCESS" },new User { USERID = "JBlack@email.com", PASSWORD = "test", FIRST_NAME = "Joe", LAST_NAME = "Black", EMAILID = "JBlack@email.com", PHONE = "764-460-8610", ACCESS_LEVEL = Roles.ANALYST.ToString(), WRITE_ACCESS = "" }
};

如何创建自定义授权特性？

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;namespace LoginDemo.CustomAttributes
{public class AuthorizeAttribute : TypeFilterAttribute{public AuthorizeAttribute(params string[] claim) : base(typeof(AuthorizeFilter)){Arguments = new object[] { claim };}}public class AuthorizeFilter : IAuthorizationFilter{readonly string[] _claim;public AuthorizeFilter(params string[] claim){_claim = claim;}public void OnAuthorization(AuthorizationFilterContext context){var IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;var claimsIndentity = context.HttpContext.User.Identity as ClaimsIdentity;if (IsAuthenticated){bool flagClaim = false;foreach (var item in _claim){if (context.HttpContext.User.HasClaim(item, item))flagClaim = true;}if (!flagClaim)context.Result = new RedirectResult("~/Dashboard/NoPermission");}else{context.Result = new RedirectResult("~/Home/Index");}return;}}
}

正如你所看到的，在上面的代码中有两个类：AuthorizeAttribute和AuthorizeFilter。

public class AuthorizeAttribute : TypeFilterAttribute
{public AuthorizeAttribute(params string[] claim) : base(typeof(AuthorizeFilter)){Arguments = new object[] { claim };}
}

此类实现了TypeFilterAttribute，依赖项容器用它来创建AuthorizeFilter的对象。AuthorizeAttribute构造函数将string数组作为参数。由于它是一个数组，因此我们可以用逗号（，）分隔的值传递角色，如[E.g.: “Director”, “Supervisor”, “Analyst”]。

public class AuthorizeFilter : IAuthorizationFilter

AuthorizeFilter类使用OnAuthorization方法实现IAuthroizationFilter接口。

public AuthorizeFilter(params string[] claim)
{_claim = claim;
}

AuthorizeFilter构造函数将strings 数组作为参数，从AuthorizeAttribute传递。

public void OnAuthorization(AuthorizationFilterContext context)

OnAuthorization方法自带AuthorizationFilterContext。从这个“上下文”中，我们可以获取HttpContext和带有声明的用户标识（User Identity）。

var IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;
var claimsIndentity = context.HttpContext.User.Identity as ClaimsIdentity;

通过“context”对象，我们可以知道用户是否已通过身份验证。使用相同的“context”对象，我们可以获得用户声明标识集合。

if (IsAuthenticated){bool flagClaim = false;foreach (var item in _claim){if (context.HttpContext.User.HasClaim(item, item))flagClaim = true;}if (!flagClaim)context.Result = new RedirectResult("~/Dashboard/NoPermission");}else{context.Result = new RedirectResult("~/Home/Index");}return;

在此块中，我们检查用户是否已通过身份验证。如果没有，我们会将用户重定向到登录页面。然后，我们遍历“claim”数组集合（此数组集合将是用户角色，我们将从控制器将其作为参数传递给该角色，例如：Authorize[new string[] “Director”, “Supervisor”]）。

public class DashboardController : Controller
{[Authorize(Roles.DIRECTOR)]public IActionResult DirectorPage(){return View("DirectorPage");}[Authorize(Roles.SUPERVISOR)]public IActionResult SupervisorPage(){ViewBag.Message = "Permission controlled through action Attribute";return View("SupervisorPage");}[Authorize(Roles.ANALYST)]public IActionResult AnalystPage(){return View("AnalystPage");}
}

操作方法用[Authorize]特性修饰。我们将用户角色作为参数传递。Director，Supervisor和Analyst每个都具有单独的操作方法。

[Authorize(Roles.DIRECTOR)]
public IActionResult DirectorPage()
{return View("DirectorPage");
}

在此'DirectorPage'操作方法中，我们使用Roles.DIRECTOR设置了Authorize特性。这意味着，只有具有Director角色的用户才能查看此页面。如果Supervisor或Analyst尝试访问该页面，则它们将从AuthorizeFilter类中重定向到“No Permission”页面。

[Authorize(Roles.DIRECTOR, Roles.SUPERVISOR, Roles.ANALYST)]
public IActionResult AllRoles()
{return View();
}

要在控制器级别设置权限，我们可以如下进行设置。如果在控制器级别设置了Authorize特性，则将为该控制器中的所有操作方法设置权限。

namespace LoginDemo.Controllers{[Authorize(Roles.DIRECTOR, Roles.SUPERVISOR, Roles.ANALYST)]    public class YourController : Controller{public IActionResult Action1(){return View();}public IActionResult Action2(){return View();}public IActionResult Action3(){return View();}}}

检查用户权限的扩展方法

namespace LoginDemo.CustomAttributes
{public static class PermissionExtension{public static bool HavePermission(this Controller c, string claimValue){var user = c.HttpContext.User as ClaimsPrincipal;bool havePer = user.HasClaim(claimValue, claimValue);return havePer;}public static bool HavePermission(this IIdentity claims, string claimValue){var userClaims = claims as ClaimsIdentity;bool havePer = userClaims.HasClaim(claimValue, claimValue);return havePer;}}
}

实现了扩展方法，可在控制器和视图页面中使用。这些方法将Claims值作为参数，并检查该Claims 是否存在于HttpContext.User Claims对象集合中。为了调用控制器中的方法，我们使用“this Controller”作为第一个参数，使其成为扩展方法。在视图页面中使用的是“this IIdentity”。

public IActionResult SupervisorAnalystPage()
{ViewBag.Message = "Permission controlled inside action method";if (this.HavePermission(Roles.SUPERVISOR))return View("SupervisorPage");if (this.HavePermission(Roles.ANALYST))return View("AnalystPage");return new RedirectResult("~/Dashboard/NoPermission");
}

在上面，我们创建了HavePermission()扩展方法。使用扩展方法，我们使用简单的“if”条件控制权限。扩展方法检查HttpContext用户声明对象集合中的用户角色。

this.HavePermission(Roles.SUPERVISOR)
this.HavePermission(Roles.ANALYST))

如何控制视图页面内部的用户权限？

@if (User.Identity.HavePermission("WRITE_ACCESS") == true)
{<button type="button"</button<>
}
else
{<button type="button" disabled="disabled"<</button>
}

在上面，我们创建了两种HavePermission()扩展方法，一种用于Controller，另一种用于View Page。在此HavePermission()检查HttpContext用户声明对象集合中的“WRITE_ACCESS”声明。如果为true，则启用保存按钮，否则为禁用。这样，我们可以根据用户的角色/权限控制“显示什么？”和“如何显示？”查看页面内容。

@if (User.Identity.HavePermission("WRITE_ACCESS") == true)

以没有WRITE权限的Analyst JBlack@email.com登录到演示项目。在登录页面中，单击“查看页面级别权限的工作原理 ”。

namespace LoginDemo.CustomAttributes
{public class UnAuthorizedAttribute : TypeFilterAttribute{public UnAuthorizedAttribute() : base(typeof(UnauthorizedFilter)){//Empty constructor}}public class UnauthorizedFilter : IAuthorizationFilter{public void OnAuthorization(AuthorizationFilterContext context){bool IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;if (!IsAuthenticated){context.Result = new RedirectResult("~/Home/Index");}}}
}

从AuthorizationFilterContext中获取用户身份对象，从中可以确定用户是否已通过身份验证。

bool IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;

如果该用户未通过身份验证或登录，请将该用户重定向到登录页面。

if (!IsAuthenticated)
{context.Result = new RedirectResult("~/Home/Index");
}

您只需在顶部添加[UnAuthorized]特性即可在控制器级别使用它，该属性适用于该控制器中的所有操作方法。Authorize特性还会检查IsAuthenticated，因此可以询问[UnAuthorized]特性的用途。在某些情况下，权限不受控制，这意味着所有用户都可以对某个操作方法具有权限，并且该操作方法没有[Authorize]特性。在下面的控制器中，SupervisorAnalystPage()操作方法没有[Authorize]特性。任何知道URL的用户都可以尝试访问它。具有[UnAuthorized]特性的另一个原因是处理Ajax调用，我们将在下一个主题中看到它。

namespace LoginDemo.Controllers
{[UnAuthorized]public class DashboardController : Controller{[Authorize(Roles.DIRECTOR)]public IActionResult DirectorPage(){return View("DirectorPage");}[Authorize(Roles.SUPERVISOR)]public IActionResult SupervisorPage(){ViewBag.Message = "Permission controlled through action Attribute";return View("SupervisorPage");}[Authorize(Roles.ANALYST)]public IActionResult AnalystPage(){return View("AnalystPage");}public IActionResult SupervisorAnalystPage(){ViewBag.Message = "Permission controlled inside action method";if (this.HavePermission(Roles.SUPERVISOR))return View("SupervisorPage");if (this.HavePermission(Roles.ANALYST))return View("AnalystPage");return new RedirectResult("~/Dashboard/NoPermission");}}
}

如何处理和身份验证/授权Ajax调用？

using Microsoft.AspNetCore.Http;using System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;namespace LoginDemo.CustomAttributes{public static class AjaxExtension{//HttpRequest Extension method to //check if the incoming request is an AJAX call - JRozario public static bool IsAjaxRequest(this HttpRequest request){if (request == null)throw new ArgumentNullException("request");if (request.Headers != null)return request.Headers["X-Requested-With"] == "XMLHttpRequest";return false;}}}

这是使用HttpRequest对象实现的简单扩展方法。我们可以发现请求是否是带有Http头“X-Requested-With”之一的Ajax调用。如果此标头值为“XMLHttpRequest”，则为Ajax调用。

return request.Headers["X-Requested-With"] == "XMLHttpRequest";

在[UnAuthorized]过滤器特性中处理Ajax调用身份验证

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Mvc.Filters;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Security.Claims;
using System.Threading.Tasks;namespace LoginDemo.CustomAttributes
{public class UnAuthorizedAttribute : TypeFilterAttribute{public UnAuthorizedAttribute() : base(typeof(UnauthorizedFilter)){//Empty constructor}}public class UnauthorizedFilter : IAuthorizationFilter{public void OnAuthorization(AuthorizationFilterContext context){bool IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;if (!IsAuthenticated){if (context.HttpContext.Request.IsAjaxRequest()){context.HttpContext.Response.StatusCode =(int)HttpStatusCode.Forbidden; //Set HTTP 403 Forbidden - JRozario}else{context.Result = new RedirectResult("~/Home/Index");}}}}
}

如您所见，检查它是否是Ajax调用的条件context.HttpContext.Request.IsAjaxRequest()。如果是Ajax调用，则不会重定向该调用。重定向将不适用于Ajax调用。Ajax调用的返回结果只能是数据。在这里，我们将Http响应状态代码设置为403 –禁止。这表示Ajax调用最终以Error结束，并且调用失败。该演示中的所有Ajax调用均使用jquery编写。jQuery Ajax调用可以从HTTP响应对象（标头）获取Http状态代码。如果是常规Http调用，则重定向到“登录”页面。我们已经完成了对Ajax请求的身份验证。接下来，我们需要将用户重定向到登录页面。

using Microsoft.AspNetCore.Mvc;using Microsoft.AspNetCore.Mvc.Filters;using System;using System.Collections.Generic;using System.Linq;using System.Net;using System.Security.Claims;using System.Threading.Tasks;namespace LoginDemo.CustomAttributes{public class AuthorizeAttribute : TypeFilterAttribute{public AuthorizeAttribute(params string[] claim) : base(typeof(AuthorizeFilter)){Arguments = new object[] { claim };}}public class AuthorizeFilter : IAuthorizationFilter{readonly string[] _claim;public AuthorizeFilter(params string[] claim){_claim = claim;}public void OnAuthorization(AuthorizationFilterContext context){var IsAuthenticated = context.HttpContext.User.Identity.IsAuthenticated;var claimsIndentity = context.HttpContext.User.Identity as ClaimsIdentity;if (IsAuthenticated){bool flagClaim = false;foreach (var item in _claim){if (context.HttpContext.User.HasClaim(item, item))flagClaim = true;}if (!flagClaim){if (context.HttpContext.Request.IsAjaxRequest())context.HttpContext.Response.StatusCode = (int)HttpStatusCode.Unauthorized; //Set HTTP 401 //Unauthorized - JRozarioelsecontext.Result = new RedirectResult("~/Dashboard/NoPermission");}}else{if (context.HttpContext.Request.IsAjaxRequest()){context.HttpContext.Response.StatusCode = (int)HttpStatusCode.Forbidden; //Set HTTP 403 - JRozario}else{context.Result = new RedirectResult("~/Home/Index");}}return;}}}

在Jquery中捕获Ajax调用的Http状态代码并重定向到登录页面

<script>$(document).ajaxError(function (xhr, result) {//Catch Ajax error with http status code 403 Forbidden //and 401 Unauthorized – Jrozarioif (result.status === 403) {window.location.href = '/Home/Index';}if (result.status === 401) {window.location.href = '/Dashboard/NoPermission';}});</script>

在其中一个参数中.ajaxError获取Http标头，在此将其声明为“result”。在“result”参数中返回在[UnAuthorized]过滤器额性中设置的Http标头和状态码403禁止。如果result.status是403，则将用户从客户端重定向到登录页面。

if (result.status === 403) {window.location.href = '/Home/Index';
}

在演示项目中，有一个页面CheckAjaxCalls.cshtml，您可以在其中检查Ajax调用的身份验证/授权。要检查身份验证，请以Director jsmith@email.com登录到演示项目。您应该看到以下页面。

<script>function OnClick_EndSession() {$.ajax({type: 'GET',url: '/Home/EndSession',data: {},cache: false,success: function (result) { }});alert("End of User Session,Click on Ajax Call button to autneticate Ajax calls,It should take you to login page.");}function OnClick_AuthenticateAjaxCall() {$.ajax({type: 'GET',url: '/Dashboard/AuthenticateAjaxCalls',data: {},cache: false,success: function (result) {if (result != "")alert("Your session is still active,end session to see how authentication for Ajax call works!");}});}function OnClick_AuthorizeAjaxCall() {$.ajax({type: 'GET',url: '/Dashboard/AuthorizeAjaxCalls',data: {},cache: false,success: function (result) {if (result != "")alert("Your have permission for this Ajax call!");}});}
</script>

以下是针对页面中3个按钮的3个Ajax调用的Controller操作方法，该方法返回Json结果。此代码位于演示项目的DashboardController.cs文件中。您可以看到“AuthorizeAjaxCalls”操作方法为Director和Supervisor设置了[Authorize]特性。

//This action method is in Dashboard.cspublic JsonResult AuthenticateAjaxCalls(){return Json(new {result = "success" });}[Authorize(Roles.DIRECTOR, Roles.SUPERVISOR)]public JsonResult AuthorizeAjaxCalls(){return Json(new { result = "success" });}//This action method is in HomeController.cs public JsonResult EndSession(){HttpContext.Session.Clear();return Json(new {result = "success"});}

现在单击“Authenticate Ajax Call”按钮。如果会话仍处于活动状态，您应该收到一条警报消息。