.NetCoreAOP之AuthorizeAttribute

一、简介

在.net core 中Filter分为以下六大类：

1、AuthorizeAttribute（权限验证）

2、IResourceFilter（资源缓存）

3、IActionFilter（执行方法前后的记录）

4、IResultFilter（结果生成前后扩展）

5、IAlwaysRun（响应结果的补充）

6、IExceptionFilter（异常处理）

二、AuthorizeAttribute(权限验证)

认证授权分为三种，如下：

1、基于角色授权

1.1、配置Startup.cs 类，使用Cookie及角色授权方式访问 —— 修改 ConfigureServices 与 Configure方法

public void ConfigureServices(IServiceCollection services)        {            services.AddControllersWithViews();            {                 // ************1、添加鉴权和授权逻辑**************************                services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>                {                    options.LoginPath = new PathString("/Login/LoginView"); // 登录地址                    options.AccessDeniedPath = new PathString("/Login/AccessDenied"); // 无权限访问需要跳转的页面地址                    options.LogoutPath = new PathString("/Login/LoginOff"); // 登出地址                    options.ExpireTimeSpan = TimeSpan.FromMinutes(1); // cookie有效时间(这里设置的1分钟有效时间)                    options.Cookie = new CookieBuilder                    {                        // cookie名称，Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")取得是当前环境变量的名称，用户可自定义                        Name = $"WebUI_{Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")}"                     };                });                services.AddAuthorization();                // **********************************************************            }        }        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.        public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory)        {            if (env.IsDevelopment())            {                app.UseDeveloperExceptionPage();            }            else            {                app.UseExceptionHandler("/Home/Error");            }            app.UseStaticFiles();            app.UseRouting();            // ***************2、鉴权*******************            app.UseAuthentication();            // 授权            app.UseAuthorization();                        app.UseEndpoints(endpoints =>            {                endpoints.MapControllerRoute(                    name: "default",                    pattern: "{controller=Login}/{action=LoginView}/{id?}");            });        }

 

1.2、使用授权的时候在Action或controller上打上Authorize特性并赋值Role属性，表示该方法只能由Admin的角色访问

public class LoginController : Controller    {        // 登录页面        public IActionResult LoginView()        {            return View();        }        /// <summary>        /// 登录方法        /// </summary>        /// <returns></returns>        [AllowAnonymous]        public async Task<IActionResult> Login()        {            var claims = new List<Claim>            {                new Claim(ClaimTypes.Name,"xiaohemiao"),                new Claim(ClaimTypes.Role,"Admin")            };            var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme                , new ClaimsPrincipal(claimsIdentity)                , new AuthenticationProperties()                {                    ExpiresUtc = DateTime.UtcNow.AddMinutes(1)                });                        return Redirect("/Login/Index");        }        /// <summary>        /// 登录成功之后跳转的页面        /// </summary>        /// <returns></returns>        [Authorize(Roles = "Admin")]        public IActionResult Index()        {            return View();        }        /// <summary>        /// 登出        /// </summary>        /// <returns></returns>        public async Task<IActionResult> LoginOff()        {            await HttpContext.SignOutAsync();            return Redirect("/Login/LoginView");        }        /// <summary>        /// 无权限页面        /// </summary>        /// <returns></returns>        public IActionResult AccessDenied()        {            return View();        }            }

 

2、基于声明授权

修改基于标题1的相关代码

public void ConfigureServices(IServiceCollection services)        {            services.AddControllersWithViews();            {                 // ************1、添加鉴权和授权逻辑**************************                services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>                {                    options.LoginPath = new PathString("/Login/LoginView"); // 登录地址                    options.AccessDeniedPath = new PathString("/Login/AccessDenied"); // 无权限访问需要跳转的页面地址                    options.LogoutPath = new PathString("/Login/LoginOff"); // 登出地址                    options.ExpireTimeSpan = TimeSpan.FromMinutes(1); // cookie有效时间(这里设置的1分钟有效时间)                    options.Cookie = new CookieBuilder                    {                        // cookie名称，Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")取得是当前环境变量的名称，用户可自定义                        Name = $"WebUI_{Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")}"                     };                });                services.AddAuthorization(options => {                    // 当角色是Admin和SuperAdministrator才可以访问                    options.AddPolicy("AdministratorOnly", policy => policy.RequireClaim(ClaimTypes.Role, "Admin", "SuperAdministrator"));                });                // **********************************************************            }        }        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.        public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory)        {            if (env.IsDevelopment())            {                app.UseDeveloperExceptionPage();            }            else            {                app.UseExceptionHandler("/Home/Error");            }            app.UseStaticFiles();            app.UseRouting();            // ***************2、鉴权*******************            app.UseAuthentication();            // 授权            app.UseAuthorization();                        app.UseEndpoints(endpoints =>            {                endpoints.MapControllerRoute(                    name: "default",                    pattern: "{controller=Login}/{action=LoginView}/{id?}");            });        }

 

public class LoginController : Controller    {        // 登录页面        public IActionResult LoginView()        {            return View();        }        /// <summary>        /// 登录方法        /// </summary>        /// <returns></returns>        [AllowAnonymous]        public async Task<IActionResult> Login()        {            var claims = new List<Claim>            {                new Claim(ClaimTypes.Name,"xiaohemiao"),                new Claim(ClaimTypes.Role,"Admin")            };            var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme                , new ClaimsPrincipal(claimsIdentity)                , new AuthenticationProperties()                {                    ExpiresUtc = DateTime.UtcNow.AddMinutes(1)                });                        return Redirect("/Login/Index");        }        /// <summary>        /// 登录成功之后跳转的页面        /// </summary>        /// <returns></returns>        [Authorize(Policy = "AdministratorOnly")]        public IActionResult Index()        {            return View();        }        /// <summary>        /// 登出        /// </summary>        /// <returns></returns>        public async Task<IActionResult> LoginOff()        {            await HttpContext.SignOutAsync();            return Redirect("/Login/LoginView");        }        /// <summary>        /// 无权限页面        /// </summary>        /// <returns></returns>        public IActionResult AccessDenied()        {            return View();        }            }

 

3、自定义策略授权

3.1、定义权限策略

 

public class PermissionRequirement: IAuthorizationRequirement    {    }

 

3.2、再定义个策略处理类

public class RoleAuthorizationHandler : AuthorizationHandler<PermissionRequirement>    {        private readonly ILogger<RoleAuthorizationHandler> _logger;        private readonly IHttpContextAccessor _httpContextAccessor;        public RoleAuthorizationHandler(ILogger<RoleAuthorizationHandler> logger, IHttpContextAccessor httpContextAccessor)        {            _logger = logger;            this._httpContextAccessor = httpContextAccessor;        }        public override Task HandleAsync(AuthorizationHandlerContext context)        {            var mvcContext = _httpContextAccessor.HttpContext;            var user = context.User.FindFirst(ClaimTypes.Role)?.Value;                       if (mvcContext.User.Identity.IsAuthenticated)            {                var routes = mvcContext.GetRouteData();                var controller = routes.Values["controller"]?.ToString()?.ToLower();                var action = routes.Values["action"]?.ToString()?.ToLower();                var activeTime = mvcContext.User.FindFirst(ClaimTypes.Expired);                // 是否登录超时                if (activeTime == null || Convert.ToDateTime(activeTime.Value) < DateTime.Now)                {                    // 登录超时自动跳转到登录页面                    mvcContext.Response.Redirect("/Login/LoginView");                    context.Succeed(context.Requirements.FirstOrDefault());                    return Task.CompletedTask;                }                var hasRole = mvcContext.User.HasClaim(c => c.Type == ClaimTypes.Role);                if (!hasRole)                {                    //用户未在系统添加,即使登录成功,也要提示没有权限                    context.Fail();                    return Task.CompletedTask;                }                var menuPaths = AuthorizationMenuPath(user);                string route = $"/{controller}";                               var actionRoute = $"/{controller}/{(routes.Values["action"] ?? "Index")}".ToLower();                if (menuPaths.Any(m => m.ToLower().Contains($"/{controller}/")) || menuPaths.Any(m => m.ToLower() == route) || menuPaths.Any(m => m.ToLower() == actionRoute))                    context.Succeed(context.Requirements.FirstOrDefault());                else context.Fail();//会默认跳转 accessdenied视图                            }            else                context.Fail();            return Task.CompletedTask;        }        protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, PermissionRequirement requirement)        {            throw new NotImplementedException();        }        /// <summary>        /// 权限动态缓存类 临时替代数据库        /// </summary>        /// <param name="roleName">角色名称</param>        /// <returns></returns>        private List<string> AuthorizationMenuPath(string roleName)        {            switch (roleName)            {                case "Admin":                    return new List<string>() { "/Login/Index" };                default:                    return new List<string>() { "/Login/Index" };            }                    }    }

 

3.3、修改 ConfigureServices 与 Configure方法

public void ConfigureServices(IServiceCollection services)        {            services.AddControllersWithViews();            {                // ************3、注入自定义策略**************************                services.AddSingleton<IAuthorizationHandler, RoleAuthorizationHandler>();                // ************1、添加鉴权和授权逻辑**************************                services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options =>                {                    options.LoginPath = new PathString("/Login/LoginView"); // 登录地址                    options.AccessDeniedPath = new PathString("/Login/AccessDenied"); // 无权限访问需要跳转的页面地址                    options.LogoutPath = new PathString("/Login/LoginOff"); // 登出地址                    options.ExpireTimeSpan = TimeSpan.FromMinutes(1); // cookie有效时间(这里设置的1分钟有效时间)                    options.Cookie = new CookieBuilder                    {                        // cookie名称，Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")取得是当前环境变量的名称，用户可自定义                        Name = $"WebUI_{Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT")}"                     };                });                services.AddAuthorization(options =>                {                    options.AddPolicy("RolePolicy", policy =>policy.Requirements.Add(new PermissionRequirement()));                                   });                services.AddHttpContextAccessor();                // **********************************************************            }        }        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.        public void Configure(IApplicationBuilder app, IWebHostEnvironment env, ILoggerFactory loggerFactory)        {            if (env.IsDevelopment())            {                app.UseDeveloperExceptionPage();            }            else            {                app.UseExceptionHandler("/Home/Error");            }            app.UseStaticFiles();            app.UseRouting();            // ***************2、鉴权*******************            app.UseAuthentication();            // 授权            app.UseAuthorization();                        app.UseEndpoints(endpoints =>            {                endpoints.MapControllerRoute(                    name: "default",                    pattern: "{controller=Login}/{action=LoginView}/{id?}");            });        }

3.4 、controller代码逻辑

public class LoginController : Controller    {        // 登录页面        public IActionResult LoginView()        {            return View();        }        /// <summary>        /// 登录方法        /// </summary>        /// <returns></returns>        [AllowAnonymous]        public async Task<IActionResult> Login()        {            var claims = new List<Claim>            {                new Claim(ClaimTypes.Name,"xiaohemiao"),                new Claim(ClaimTypes.Role,"Admin"),                new Claim(ClaimTypes.Expired,DateTime.Now.AddMinutes(1).ToString("yyyy-MM-dd HH:mm:ss"))                            };            var claimsIdentity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme);            await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme                , new ClaimsPrincipal(claimsIdentity)                , new AuthenticationProperties()                {                                    });                        return Redirect("/Login/Index");        }        /// <summary>        /// 登录成功之后跳转的页面        /// </summary>        /// <returns></returns>        [Authorize(Policy = "RolePolicy")]        public IActionResult Index()        {            return View();        }        /// <summary>        /// 登出        /// </summary>        /// <returns></returns>        public async Task<IActionResult> LoginOff()        {            await HttpContext.SignOutAsync();            return Redirect("/Login/LoginView");        }        /// <summary>        /// 无权限页面        /// </summary>        /// <returns></returns>        public IActionResult AccessDenied()        {            return View();        }            }

 

三、简单页面呈现效果

1、登录页面

 

 

2、登录成功跳转的页面

 

 

3、无权限页面