ABP框架源码学习之授权逻辑

asp.net core的默认的几种授权方法参考“雨夜朦胧”的系列博客，这里要强调的是asp.net core mvc中的授权和asp.net mvc中的授权不一样，建议先看前面“雨夜朦胧”的博客。

Abp中Controller里面用到的权限验证类为：AbpMvcAuthorizeAttribute，ApplicationService里面用到的权限验证类为：AbpAuthorizeAttribute（见下图）。

ABP框架源码学习之授权逻辑

AbpMvcAuthorizeAttribute和AbpAuthorizeAttribute这两个类全部继承自IAbpAuthorizeAttribute（重要！！！），下面是这两个类的源码。

 1 namespace Abp.Authorization
 2 {
 3     /// <summary>
 4     /// This attribute is used on a method of an Application Service (A class that implements <see cref="IApplicationService"/>)
 5     /// to make that method usable only by authorized users.
 6     /// </summary>
 7     [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = true)]
 8     public class AbpAuthorizeAttribute : Attribute, IAbpAuthorizeAttribute
 9     {
10         /// <summary>
11         /// A list of permissions to authorize.
12         /// </summary>
13         public string[] Permissions { get; }
14 
15         /// <summary>
16         /// If this property is set to true, all of the <see cref="Permissions"/> must be granted.
17         /// If it's false, at least one of the <see cref="Permissions"/> must be granted.
18         /// Default: false.
19         /// </summary>
20         public bool RequireAllPermissions { get; set; }
21 
22         /// <summary>
23         /// Creates a new instance of <see cref="AbpAuthorizeAttribute"/> class.
24         /// </summary>
25         /// <param name="permissions">A list of permissions to authorize</param>
26         public AbpAuthorizeAttribute(params string[] permissions)
27         {
28             Permissions = permissions;
29         }
30     }
31 }

View Code