阻止在ASP.NET MVC中缓存属性,每次执行一个Action时强制执行属性

Question

根据各种文章(例如此处和此处),ASP.NET MVC Actions上的属性结果可能会被缓存,并且在调用控制器操作时不会再次执行.

在我的情况下,这种行为是不可取的(例如,我有一个基于我自己的属性和IP的授权系统,每次都需要执行的角色检查,以及其他事情).

如何阻止ASP.NET MVC缓存我的属性/属性执行结果并保证每次都执行它们？

Answer 1

查看 AuthorizeAttribute 的源代码（在 Codeplex 上或通过 Reflector），了解它如何关闭授权页面的缓存。我将其重构为派生自 AuthorizeAttribute 的自定义授权属性上的单独方法。

protected void CacheValidateHandler( HttpContext context, object data, ref HttpValidationStatus validationStatus )
{
    validationStatus = OnCacheAuthorization( new HttpContextWrapper( context ) );
}

protected void SetCachePolicy( AuthorizationContext filterContext )
{
    // ** IMPORTANT **
    // Since we're performing authorization at the action level, the authorization code runs
    // after the output caching module. In the worst case this could allow an authorized user
    // to cause the page to be cached, then an unauthorized user would later be served the
    // cached page. We work around this by telling proxies not to cache the sensitive page,
    // then we hook our custom authorization code into the caching mechanism so that we have
    // the final say on whether a page should be served from the cache.
    HttpCachePolicyBase cachePolicy = filterContext.HttpContext.Response.Cache;
    cachePolicy.SetProxyMaxAge( new TimeSpan( 0 ) );
    cachePolicy.AddValidationCallback( CacheValidateHandler, null /* data */);
}