Question

我有一个基本控制器：

public abstract class EntityController<T> : ApiController
{
    [HttpPost]
    [ValidateModel]
    public abstract IHttpActionResult Create(T dto);

    [HttpPut]
    [ValidateModel]
    public abstract IHttpActionResult Update(T dto);

    [HttpDelete]
    public abstract IHttpActionResult Delete(int id);
}

派生控制器：

public class CustomerTypeController : EntityController<CustomerTypeDTO>
{
    [ApiAuthorize(Right = Rights.CustomerType, Action = Action.Create)]
    public override IHttpActionResult Create(CustomerTypeDTO  customerType)
    {
        return Save(customerType);
    }

    [ApiAuthorize(Right = Rights.CustomerType, Action = Action.Update)]
    public override IHttpActionResult Update(CustomerTypeDTO  customerType)
    {
        return Save(customerType);
    }

    private IHttpActionResult Save(CustomerTypeDTO customerType)
    {
        //service layer save customer type
    }
}

基本控制器在动作上有[ValidateModel]，而派生控制器设置它自己的[ApiAuthorize]属性。以正确的顺序触发属性（首先是ApiAuthorize，然后是ValidateModel）。我没有订单，我不知道是否可能。

ApiAuthorize看起来像这样：

[AttributeUsage(AttributeTargets.Method, AllowMultiple=false)]
public class ApiAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        base.OnAuthorization(actionContext);

        //Do some checks...

        if (!authorized)
          actionContext.Request.CreateErrorResponse(HttpStatusCode.Forbidden, new CustomNotAuthorizedException());
    }
 }

然而，问题在于，即使属性创建了错误响应，该操作仍然会进一步进入ValidateModel然后进入操作本身。

如何阻止api在Authorize和ValidateModel级别进一步处理请求？

Answer 1

问题是Authorize属性代码没有设置响应。它必须是这样的：

if (!authorized)
{
    var response = actionContext.Request.CreateErrorResponse(HttpStatusCode.Forbidden, new CustomNotAuthorizedException());
    actionContent.Response = response;
}

Web Api忽略Attribute中的CreateErrorResponse

1 个答案: