ASP.NET MVC编程——验证、授权与安全

    [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
    public class AuthorizeAttribute : FilterAttribute, IAuthorizationFilter
    {
        public AuthorizeAttribute(); 

        // 获取或设置有权访问控制器或操作方法的用户角色
        public string Roles { get; set; }
        
        //获取此特性的唯一标识符。
        public override object TypeId { get; }

        // 获取或设置有权访问控制器或操作方法的用户。
        public string Users { get; set; }

        //重写时，提供一个入口点用于进行自定义授权检查
        // 返回结果: 如果用户已经过授权，则为 true；否则为 false。
        // 异常:System.ArgumentNullException:httpContext 参数为 null。
        protected virtual bool AuthorizeCore(HttpContextBase httpContext);

        //处理未能授权的 HTTP 请求。
        protected virtual void HandleUnauthorizedRequest(AuthorizationContext filterContext);

        //在过程请求授权时调用。
        // 异常: System.ArgumentNullException:
        //filterContext 参数为 null。
        public virtual void OnAuthorization(AuthorizationContext filterContext);
        
        // 返回结果: 对验证状态的引用。
        // 异常:System.ArgumentNullException:
        // httpContext 参数为 null。
        protected virtual HttpValidationStatus OnCacheAuthorization(HttpContextBase httpContext);
}

        public virtual void OnAuthorization(AuthorizationContext filterContext)
        {
            if (filterContext == null)
            {
                throw new ArgumentNullException("filterContext");
            }

            //如果子操作的缓存处于活动状态，那么就抛出异常
            if (OutputCacheAttribute.IsChildActionCacheActive(filterContext))
            {
                throw new InvalidOperationException(MvcResources.AuthorizeAttribute_CannotUseWithinChildActionCache);
            }

            //判断控制器或控制器操作是否允许匿名访问，如果可以就return
            bool skipAuthorization = filterContext.ActionDescriptor.IsDefined(typeof(AllowAnonymousAttribute), inherit: true)|| filterContext.ActionDescriptor.ControllerDescriptor.IsDefined(typeof(AllowAnonymousAttribute), inherit: true);

            if (skipAuthorization)
            {
                return;
            }

            //进行权限验证
            if (AuthorizeCore(filterContext.HttpContext))
            {
                HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
                cachePolicy.SetProxyMaxAge(new TimeSpan(0));
                cachePolicy.AddValidationCallback(CacheValidateHandler, null /* data */);
            }
            else
            {//处理未通过权限验证的情形
                HandleUnauthorizedRequest(filterContext);
            }
        }

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
        private UserRole role;
        public CustomAuthorizeAttribute(UserRole role)
        {
            this.role = role;
        }
        protected override bool AuthorizeCore(HttpContextBase httpContext)
        {
            bool ret = false;

            //获得用户信息(从本地Session或分布式缓存中获取)
            var userInfo = ......
            if(userInfo==null)
            {
                //信息为null，一般认为登陆超时或没有登陆
            }

            if(userInfo.Role == UserRole.Org)
            {
                ret = true;
            }
            else
            {
                //提示无权限
            }

            return ret;
        }
        protected override void HandleUnauthorizedRequest(AuthorizationContext filterContext)
        {
            if (filterContext == null)
            {
                throw new ArgumentNullException("filterContext");
            }

            if (filterContext.HttpContext.Request.IsAjaxRequest())
            {//针对ajax请求进行处理
                
            }
            else
            {//非aiax进行处理
                
                //跳转到指定页面
                string strUrl = ......;
                filterContext.Result = new RedirectResult(strUrl);
            }
        }
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            base.OnAuthorization(filterContext);
        }
    }
    public enum UserRole
    {
        Org = 1,
        Vip = 2,
        Guest = 3
}

<h4>@Model.Field</h4>

<system.web>
    <httpRuntime targetFramework="4.5" encoderType="System.Web.Security.AntiXss.AntiXssEncoder,System.Web"/>
</system.web>

public class CSRFFilter:AuthorizeAttribute
{
        public override void OnAuthorization(AuthorizationContext filterContext)
        {
            if (filterContext.HttpContext == null)
            {
                throw new HttpException("请求无效");
            }

            if (filterContext.HttpContext.Request.UrlReferrer == null)
            {
                throw new HttpException("请求无效");
            }

            if (filterContext.HttpContext.Request.UrlReferrer.Host != "sit.com")
            {
                throw new HttpException("来自非法网站");
            }
        }
}

public ActionResult TestViewData([Bind(Include = "Field,Field1,Field1")]ModelF mf)
{
     ......
}