确定当前页面是否需要授权？

Question

所以,我有像web.configs这样的网络应用程序:

<authorization>
  <deny users="?"/>
</authorization>
...
<location path="SomeUnsecuredPage.aspx">
  <system.web>
    <authorization>
      <allow users="*"/>
    </authorization>
  </system.web>
</location>

换句话说,大多数页面需要身份验证和授权,但有些则不需要.

然后我有一个IHttpModule,将被所有不同的应用程序使用.我想要做的就是检查当前的请求是否"完全".如果页面不需要授权,我不希望我的IHttpModule做任何事情.我正在使用FormsAuthentication,我认为FormsAuthentication已经将所有这些信息缓存到某个地方,不是吗？此外,由于此检查将持续运行,因此必须非常快.

我目前正在订阅HttpApplication.AuthorizeRequest,但令人惊讶的是,即使对于允许匿名访问的资源,此事件也会触发.

有任何想法吗？谢谢阅读!

Answer 1

您可以只使用通用标识,而不是创建一个盗版主体/标识.

public bool IsAnonymousAccessAllowed()
{
   return UrlAuthorizationModule.CheckUrlAccessForPrincipal(Request.Path, new GenericPrincipal(new GenericIdentity(""), new string[0]), Request.RequestType);
}

Answer 2

创建一个盗版 IPrincipal，然后您必须使用它。如果盗版主体具有访问权限，则允许匿名访问。

public static class AnonymousAccessCheck
            {
                public static bool IsAnonymousAccessAllowed(HttpRequest request)
                {
                    // unfortunately checking if a page allows anonymous access is more complicated than you'd think(I think).
                    // here we have to create a "Fake" IPrincipal that will only ever have access to 
                    // pages that allow anonymous access.  That way if our fake principal has access,
                    // then anonymous access is allowed

                    UrlAuthorizationModule urlAuthorizationModule = new UrlAuthorizationModule();
                    return UrlAuthorizationModule.CheckUrlAccessForPrincipal(request.Path, AnonymousPrincipal.Instance, request.RequestType);
                }

                private class AnonymousPrincipal : IPrincipal
                {
                    private static AnonymousPrincipal _Instance;
                    public static AnonymousPrincipal Instance
                    {
                        get
                        {
                            if (_Instance == null)
                                _Instance = new AnonymousPrincipal();

                            return _Instance; 
                        }
                    }

                    private AnonymousPrincipal()
                    {
                        _Identity = new AnonymousIdentity();
                    }

                    private readonly IIdentity _Identity;

                    #region IPrincipal Members

                    public IIdentity Identity
                    {
                        get { return _Identity; }
                    }

                    public bool IsInRole(string role)
                    {
                        return false;
                    }

                    #endregion

                    private class AnonymousIdentity : IIdentity
                    {
                        #region IIdentity Members
                        public string AuthenticationType
                        {
                            get { return string.Empty; }
                        }

                        public bool IsAuthenticated
                        {
                            get { return false; }
                        }

                        public string Name
                        {
                            get { return string.Empty; }
                        }
                        #endregion
                    }
                }
            }