How to use Asp.Net Mvc ActionFilterAttribute for form authentication

如何使用ASP.NET MVC Framework Preview 2 中ActionFilterAttribute属性设计Form用户验证

首先采用BaseController继承Controller以改写保护方法RedirectToAction为公有方法（用以在ActionFilterAttribute属性中使用），本例中扩展了两个属性RequireLoginAttribute 、 RequireRoleAttribute；在RequireLoginAttribute属性过滤中重定向为登录的用户到登录窗户、在 RequireRoleAttribute属性过滤中将非该用户角色的操作显示访问拒绝信息，具体代码如下： 

基础请看 David Hayden [MVP C#] 的 actionfilterattribute-in-asp-net-mvc-framework

This code is my extended ActionFilterAttribute as RequireLoginAttribute and RequireRoleAttribute for form authentication, I just write the BaseController to public the Controller's RedirectToAction function for use it in extended ActionFilterAttribute.

Just for fun with coding！

namespace Bolik.Web.Mvc

{

  using System;

  using System.Web.Mvc;

  using System.Threading;



  public class BaseController : Controller

  {   

    protected override void Execute(ControllerContext controllerContext)

    {      

      try

      {

        base.Execute(controllerContext);

      }

      catch (Exception e)

      {

        if (!(e is ThreadAbortException))

        {

          ViewData["ErrorMessage"] = e.Message;

          RenderView("Error", ViewData);

        }

      }

    }    



    public new void RedirectToAction(string actionName, string controllerName)

    {

      base.RedirectToAction(actionName, controllerName);

    }

  }

  

  public class RequireLoginAttribute : ActionFilterAttribute

  {

    public override void OnActionExecuting(FilterExecutingContext filterContext)

    {

      if (filterContext.Controller is BaseController)

      {

        var b = filterContext.Controller as BaseController;

        if (b != null)

        {

          if (!b.User.Identity.IsAuthenticated)

          {

            filterContext.Cancel = true;

            b.RedirectToAction("Login", "Security");

          }

        }

      }

      base.OnActionExecuting(filterContext);

    }

  }



  public class RequireRoleAttribute : ActionFilterAttribute

  {

    private readonly string _RoleName;



    public RequireRoleAttribute(string roleName)

    {

      _RoleName = roleName;

    }



    public override void OnActionExecuting(FilterExecutingContext filterContext)

    {

      if (filterContext.Controller is BaseController)

      {

        var b = filterContext.Controller as BaseController;

        if (b != null)

        {

          if (!b.User.IsInRole(_RoleName))

          {

            filterContext.Cancel = true;

            b.RedirectToAction("AccessDenied", "Error");

          }

        }

      }

      base.OnActionExecuting(filterContext);

    }

  }

}

 

使用代码如下：

namespace Bolik.Controllers

{

  using System;

  using System.Web.Security;

  using System.Web.Routing;

  using System.Web.Mvc;  
 using Bolik.Web.Mvc;

  using Binding = System.Web.Mvc.BindingHelperExtensions;



  public class HomeController : BaseController

  {

    public void Index(string name)

    {

      RenderView("Index");

    }



    public void About()

    {

      RenderView("About")

    }



    public void FourOhFour()

    {

      throw new ArgumentException();

    }



    public void FiveOhOh()

    {

      throw new ApplicationException();

    }



    [RequireLogin]

    public void Secure()

    {

      RenderView("Secure");

    }



    [RequireRole("Administrator")]

    public void AdminsOnly()

    {

       RenderView("AdminsOnly");

    }   

  }

 

  public class SecurityController : BaseController

  {

    public void Login()

    {

      RenderView("Login");

    }  



    [RequireLogin]

    public void Logout()

    {

      FormsAuthentication.SignOut();

      Response.Redirect("/");      

    }



    public void Authenticate()

    {

      string userName = Request.Form["userName"];

      string password = Request.Form["password"];

      string rememberMe = Request.Form["rememberMe"];



      if (Membership.ValidateUser(userName, password))

      {

        FormsAuthentication.SetAuthCookie(userName, (rememberMe != null));

        RedirectToAction("index", "Home");       

      }

    }    

  }

}