asp net-5 mvc-6中的自定义授权ActionResult

Question

在 ASP.NET 4 MVC5 中，我有这个 class 允许我 return 对 JSON 端点的未经身份验证的响应进行自定义响应。在这里。

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
    {
        if (IsAjax(filterContext))
        {
            filterContext.Result = new JsonResult
            {
                JsonRequestBehavior = JsonRequestBehavior.AllowGet,
                Data = new
                {
                    success = false,
                    error = "You must be signed in."
                }
            };
        }
        else
        {
            base.HandleUnauthorizedRequest(filterContext);
        }
    }

    private bool IsAjax(AuthorizationContext filterContext)
    {
        return filterContext.ActionDescriptor.GetFilterAttributes(true).OfType<AjaxAttribute>().FirstOrDefault() !=
                null;
    }
}

但是，在 MVC6 中，新的 AuthorizeAttribute 不会覆盖创建自定义 IActionResult 结果。我如何在 MVC6 中执行此操作？

Answer 1

看了源码终于明白了

public class CustomCookieAuthenticationEvents : CookieAuthenticationEvents
{
    Func<CookieRedirectContext, Task> _old;
    public CustomCookieAuthenticationEvents()
    {
        _old = OnRedirectToLogin;
        OnRedirectToLogin = OnCustomRedirectToLogin;
    }

    public Task OnCustomRedirectToLogin(CookieRedirectContext context)
    {
        var actionContext = context.HttpContext.RequestServices.GetRequiredService<IActionContextAccessor>();
        if (actionContext.ActionContext == null)
            return _old(context);

        if (actionContext.ActionContext.ActionDescriptor.FilterDescriptors.Any(x => x.Filter is AjaxAttribute))
        {
            // this is an ajax request, return custom JSON telling user that they must be authenticated.
            var serializerSettings = context
                .HttpContext
                .RequestServices
                .GetRequiredService<IOptions<MvcJsonOptions>>()
                .Value
                .SerializerSettings;

            context.Response.ContentType = "application/json";

            using (var writer = new HttpResponseStreamWriter(context.Response.Body, Encoding.UTF8))
            {
                using (var jsonWriter = new JsonTextWriter(writer))
                {
                    jsonWriter.CloseOutput = false;
                    var jsonSerializer = JsonSerializer.Create(serializerSettings);
                    jsonSerializer.Serialize(jsonWriter, new
                    {
                        success = false,
                        error = "You must be signed in."
                    });
                }
            }

            return Task.FromResult(0);
        }
        else
        {
            // this is a normal request to an endpoint that is secured.
            // do what ASP.NET used to do.
            return _old(context);
        }
    }
}

然后，使用这个事件class如下：

services.Configure<IdentityOptions>(options =>
{
    options.Cookies.ApplicationCookie.Events = new CustomCookieAuthenticationEvents();
});

ASP.NET 5 确实让简单的事情变得更难了。当然，我现在可以在不影响其他部分的情况下更精细地自定义内容。此外，源代码非常容易 read/understand。我很高兴有信心我遇到的任何问题都可以很容易地被识别为错误或通过查看源代码来解决。

为未来干杯！

Answer 2

@blowdart 在中提出了一个很好的观点，即 returning 401/403 是否应该是预期的行为。无论如何，我尝试了一种不同的方法来完成 OP 的要求，修改默认 MVC 授权过滤器的行为，以便我们 return 在用户未经授权时 json。

我做的第一件事是创建一个新的 IAsyncAuthorizationFilter，它将未经授权的结果格式化为 ajax 请求的 json。它基本上会：

封装现有过滤器
执行包装过滤器
如果用户未经包装过滤器授权，return 一个 json 用于 ajax 个请求

这将是 CustomJsonAuthorizationFilter class:

public class CustomJsonAuthorizationFilter : IAsyncAuthorizationFilter
{
    private AuthorizeFilter wrappedFilter;
    public CustomJsonAuthorizationFilter(AuthorizeFilter wrappedFilter)
    {
        this.wrappedFilter = wrappedFilter;
    }

    public async Task OnAuthorizationAsync(Microsoft.AspNet.Mvc.Filters.AuthorizationContext context)
    {
        await this.wrappedFilter.OnAuthorizationAsync(context);
        if(context.Result != null && IsAjaxRequest(context))
        {
            context.Result = new JsonResult(new
            {
                success = false,
                error = "You must be signed in."
            });
        }
        return;
    }

    //This could be an extension method of the HttpContext/HttpRequest
    private bool IsAjaxRequest(Microsoft.AspNet.Mvc.Filters.AuthorizationContext filterContext)
    {
        return filterContext.HttpContext.Request.Headers["X-Requested-With"] == "XMLHttpRequest";
    }
}

然后我创建了一个 IApplicationModelProvider 以包装所有现有的 AuthorizeFilter with the new custom filter. The AuthroizeFilter is added by AuthorizationApplicationModelProvider，但是新提供者将在默认提供者之后运行，因为默认提供者的顺序是-990.

public class CustomFilterApplicationModelProvider : IApplicationModelProvider
{
    public int Order
    {
        get { return 0; }
    }

    public void OnProvidersExecuted(ApplicationModelProviderContext context)
    {
        //Do nothing
    }

    public void OnProvidersExecuting(ApplicationModelProviderContext context)
    {
        this.ReplaceFilters(context.Result.Filters);
        foreach(var controller in context.Result.Controllers)
        {
            this.ReplaceFilters(controller.Filters);
            foreach (var action in controller.Actions)
            {
                this.ReplaceFilters(action.Filters);
            }
        }
    }

    private void ReplaceFilters(IList<IFilterMetadata> filters)
    {
        var authorizationFilters = filters.OfType<AuthorizeFilter>().ToList();
        foreach (var filter in authorizationFilters)
        {
            filters.Remove(filter);
            filters.Add(new CustomJsonAuthorizationFilter(filter));
        }
    }
}

最后，使用新的应用程序模型提供程序在启动时更新 ConfigureServices：

services.TryAddEnumerable(
            ServiceDescriptor.Transient<IApplicationModelProvider, CustomFilterApplicationModelProvider>());

asp net-5 mvc-6中的自定义授权ActionResult

Custom authorization IActionResults in aspnet-5 mvc-6

c#

asp.net-core

authorization

asp.net-core-mvc

actionresult