如何在自定义AuthorizeAttribute中允许[Authorize]

Question

我有这样的自定义AuthorizeAttribute

public class DevMode : AuthorizationFilterAttribute
{
    public override void OnAuthorization(HttpActionContext actionContext)
    {
        if (myConditionToAuthorize)
        {
            // how to allow [Authorize] ?
        }
    }
}

问题是它与[Authorize]标签一起使用,如下所示:

[Authorize, DevMode]
public class UserController : ApiController { ... }

我需要让[Authorize] == true内心[DevMode]

或者最好将它们放在一个独特的授权类中？但后来我不知道检查授权数据.

Answer 1

或者最好将它们放在一个独特的授权类中？

哦,是的,那确实会更好.您可以简单地从中派生AuthorizeAttribute并调用基本方法:

public class DevModeAttribute : AuthorizeAttribute
{
    protected override bool IsAuthorized(HttpActionContext actionContext)
    {
        var authorize = base.IsAuthorized(actionContext);
        if (!authorized)
        {
            // the user is not authorized, no need to go any further
            return false;
        }

        // now apply your custom authorization logic here and return true or false
        ...
    }
}

然后:

[DevMode]
public class UserController : ApiController { ... }