Question

 public class CustomAuthorizeAttribute : AuthorizationFilterAttribute
 {  
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
       return true;// if my current user is authorised
    }
 }

上面是我的CustomAuthorizeAttribute类和

[CustomAuthorize] // both [CustomAuthorize] and [CustomAuthorizeAttribute ] I tried 
public class ProfileController : ApiController
{
   //My Code..
}

当我打电话时

http://localhost:1142/api/Profile

没有解雇CustomAuthorizeAttribute

我的FilterConfig类的内容如下所示

public class FilterConfig
{
    public static void RegisterGlobalFilters(GlobalFilterCollection filters)
    {            
        filters.Add(new CustomAuthorizeAttribute());
    }
}

如果我错过了什么，请帮助。

Answer 1

看起来您使用的是MVC过滤器而不是Web API过滤器。它可以在样本中检测到，因为它使用HttpContextBase。而是使用System.Web.Http.Filters命名空间中的过滤器。
您需要在Web API过滤器上覆盖OnAuthorization 或 OnAuthorizationAsync。
您无需注册全局过滤器并使用它来装饰控制器。注册它将使其适用于所有控制器。

Web API过滤器代码： https://aspnetwebstack.codeplex.com/SourceControl/latest#src/System.Web.Http/Filters/AuthorizationFilterAttribute.cs

Answer 2

你的自定义属性应该继承自 System.Web.Http.Filters.AuthorizationFilterAttribute

它看起来应该是这样的

using System.Web.Http.Controllers;
using System.Web.Http.Filters;
public class CustomAuthorizeAttribute : System.Web.Http.Filters.AuthorizationFilterAttribute
{   
    public override bool AllowMultiple
    {
        get { return false; }
    }

    public override void OnAuthorization(HttpActionContext actionContext)
    {
        //Perform your logic here
        base.OnAuthorization(actionContext);
    }
}

Answer 3

试试这个。

public class CustomAuthorizeAttribute : AuthorizeAttribute
{
    protected override bool IsAuthorized(System.Web.Http.Controllers.HttpActionContext actionContext)
    {
        return true;
    }
}

Answer 4

要添加从System.Web.Http.Filters.AuthorizationFilterAttribute继承的其他答案，我将其放入我的OnAuthorization方法中以确保用户已登录：

if (!actionContext.RequestContext.Principal.Identity.IsAuthenticated)
{
     // or whatever sort you want to do to end the execution of the request
     throw new HttpException(403, "Forbidden");
}

自定义授权属性在Web API中不起作用

4 个答案: