ASP.NET MVC使用自定义角色提供程序重定向到访问被拒绝页面

Question

我正在创建一个自定义角色提供程序,我设置了一个Authorize属性,在我的控制器中指定一个角色,它工作正常,如下所示:

[Authorize(Roles="SuperAdmin")]
public class SuperAdminController : Controller
...

但是当用户无法访问此控制器时,他将被重定向到登录页面.如何将他重定向到"AcessDenied.aspx"页面？

Answer 1

[AccessDeniedAuthorize(Roles="SuperAdmin")]
public class SuperAdminController : Controller

AccessDeniedAuthorizeAttribute.cs:

public class AccessDeniedAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);

        if(filterContext.Result is HttpUnauthorizedResult)
        {
            filterContext.Result = new RedirectResult("~/AcessDenied.aspx");
        }
    }
}

Answer 2

这是我的解决方案,基于eu-ge-ne的答案.如果用户未登录,我们会正确地将用户重定向到"登录"页面,如果用户已登录但未经授权查看该页面,则会将其重定向到"拒绝访问"页面.

[AccessDeniedAuthorize(Roles="SuperAdmin")]
public class SuperAdminController : Controller

AccessDeniedAuthorizeAttribute.cs:

public class AccessDeniedAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);
        if (!filterContext.HttpContext.User.Identity.IsAuthenticated)
        {
            filterContext.Result = new RedirectResult("~/Account/Logon");
            return;
        }

        if (filterContext.Result is HttpUnauthorizedResult)
        {
            filterContext.Result = new RedirectResult("~/Account/Denied");
        }
    }
}

AccountController.cs:

public ActionResult Denied()
{
    return View();
}

Views/Account/Denied.cshtml :( Razor语法)

@{
    ViewBag.Title = "Access Denied";
}

<h2>@ViewBag.Title</h2>

Sorry, but you don't have access to that page.

Answer 3

从这个非常相似的问题看看tvanfosson的答案,这就是我正在做的事(感谢tvanfosson),所以现在我只需要说:

[MyAuthorize(Roles="SuperAdmin",ViewName="AccessDenied")]
public class SuperAdminController : Controller
...

如果用户不在角色中,他们将获得ViewName指定的视图.

Answer 4

通过避免对Logon页面进行硬编码以及可选地在属性中设置访问被拒绝视图,对Matt的答案略有改进:

public class AccessDeniedAuthorizeAttribute : AuthorizeAttribute
{
    public string AccessDeniedViewName { get; set; }

    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        base.OnAuthorization(filterContext);

        if (filterContext.HttpContext.User.Identity.IsAuthenticated &&
            filterContext.Result is HttpUnauthorizedResult)
        {
            if (string.IsNullOrWhiteSpace(AccessDeniedViewName))
                AccessDeniedViewName = "~/Account/AccessDenied";

            filterContext.Result = new RedirectResult(AccessDeniedViewName);
        }
    }
}

Answer 5

重定向并不总是最佳解决方案

使用标准的http代码403:

return new HttpStatusCodeResult(HttpStatusCode.Forbidden);