WebApi 自定义授权属性

Question

我一直在研究这个问题。 我一直在尝试为 WebApi 实现自定义授权属性。我已经阅读了多篇关于如何执行此操作的文章，但由于某种原因，从未执行过授权。

public class ActivityAuthorizeWebApiAttribute : System.Web.Http.AuthorizeAttribute
{
    private string[] Activities { get; set; }
    public string Activity
    {
        set
        {
            this.Activities = value.Split(',').Select(x => x.Trim()).ToArray();
        }
        get { return string.Join(",", this.Activities); }
    }

    public ActivityAuthorizeWebApiAttribute()
    {
    }

    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var principalUser = HttpContext.Current.User;
        if (principalUser == null || !principalUser.Identity.IsAuthenticated)
        {
            return false;
        }

        if (!principalUser.Activities().Any())
        {
            var activityProvider = (IActivityProvider)GlobalConfiguration.Configuration.DependencyResolver.GetService(typeof(IActivityProvider));
            var activities = activityProvider.GetActivitiesByRoleId(principalUser.Identity.GetUserId());
            principalUser.SetActivities(activities);

        }

        return principalUser.HasAnyActivity(this.Activities.ToList());

        //check your permissions
    }

}

我可以看到我继承自正确的 AuthorizeAtribute，而不是 mvc。但是永远不会调用 IsAuthorized 方法。 控制器动作

[ActivityAuthorizeWebApi(Activity = "Home")]
public IEnumerable<string> Get()
{
    return new string[] { "value1", "value2" };
}

会不会是和bearer token Authentication结合的原因？

编辑： 我什至只尝试过这段代码：

public class CustomAuthorize : System.Web.Http.AuthorizeAttribute
{
}

作为自定义代码，而不是授权被执行。

Answer 1

创建自定义属性时，您需要使用以下方法：

 public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)

 protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

 private bool AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

您需要覆盖并执行您的安全逻辑的 OnAuthorization 方法。您可以从签名方法中的 actionContext 中获取 User。

public class CustomAuthorizeAttribute : AuthorizeAttribute

    {

         public override void OnAuthorization(System.Web.Http.Controllers.HttpActionContext actionContext)

        {

            if (AuthorizeRequest(actionContext))

            {

                return;

            }

            HandleUnauthorizedRequest(actionContext);

        }

        protected override void HandleUnauthorizedRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

        {

           //Code to handle unauthorized request

        }

        private bool AuthorizeRequest(System.Web.Http.Controllers.HttpActionContext actionContext)

        {

            //Write your code here to perform authorization

            return true;

        }

    }